@serve.zone/interfaces 22.0.0 → 23.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/changelog.md +12 -0
- package/dist_ts/00_commitinfo_data.js +1 -1
- package/dist_ts/appstore/types.d.ts +31 -16
- package/dist_ts/appstore/types.js +208 -11
- package/dist_ts/data/deploymentoperation.js +6 -20
- package/dist_ts/data/deploymentpreflight.d.ts +2 -6
- package/dist_ts/data/deploymentpreflight.js +1 -1
- package/dist_ts/data/hostedapp.d.ts +40 -14
- package/dist_ts/data/hostedapp.js +90 -1
- package/dist_ts/data/immutableimage.d.ts +30 -1
- package/dist_ts/data/immutableimage.js +103 -1
- package/dist_ts/data/index.d.ts +0 -2
- package/dist_ts/data/index.js +1 -3
- package/dist_ts/data/secret.d.ts +186 -13
- package/dist_ts/data/secret.js +543 -45
- package/dist_ts/data/service.d.ts +0 -39
- package/dist_ts/data/service.js +1 -77
- package/dist_ts/data/settings.d.ts +62 -43
- package/dist_ts/data/settings.js +34 -2
- package/dist_ts/platform/storage.d.ts +13 -14
- package/dist_ts/platform/storage.js +1 -1
- package/dist_ts/platform/storagemigration.d.ts +8 -8
- package/dist_ts/platform/storagemigration.golden.d.ts +2 -2
- package/dist_ts/platform/storagemigration.golden.js +19 -88
- package/dist_ts/platform/storagemigration.js +46 -58
- package/dist_ts/platform/types.d.ts +5 -19
- package/dist_ts/plugins.d.ts +2 -1
- package/dist_ts/plugins.js +3 -2
- package/dist_ts/requests/hostedapp.d.ts +12 -9
- package/dist_ts/requests/hostedapp.js +38 -1
- package/dist_ts/requests/index.d.ts +1 -3
- package/dist_ts/requests/index.js +2 -4
- package/dist_ts/requests/platform.d.ts +0 -1
- package/dist_ts/requests/secret.d.ts +23 -17
- package/dist_ts/requests/secret.js +161 -2
- package/dist_ts/requests/service.d.ts +0 -13
- package/dist_ts/requests/settings.d.ts +3 -3
- package/dist_ts/runtime.d.ts +78 -26
- package/dist_ts/runtime.js +219 -19
- package/package.json +2 -1
- package/readme.md +106 -28
- package/ts/00_commitinfo_data.ts +1 -1
- package/ts/appstore/types.ts +251 -25
- package/ts/data/deploymentoperation.ts +7 -31
- package/ts/data/deploymentpreflight.ts +2 -5
- package/ts/data/hostedapp.ts +144 -18
- package/ts/data/immutableimage.ts +150 -1
- package/ts/data/index.ts +0 -2
- package/ts/data/secret.ts +775 -53
- package/ts/data/service.ts +0 -118
- package/ts/data/settings.ts +70 -80
- package/ts/platform/storage.ts +15 -16
- package/ts/platform/storagemigration.golden.ts +18 -95
- package/ts/platform/storagemigration.ts +57 -87
- package/ts/platform/types.ts +6 -19
- package/ts/plugins.ts +2 -0
- package/ts/requests/hostedapp.ts +50 -9
- package/ts/requests/index.ts +0 -4
- package/ts/requests/platform.ts +0 -1
- package/ts/requests/secret.ts +204 -9
- package/ts/requests/service.ts +0 -16
- package/ts/requests/settings.ts +3 -3
- package/ts/runtime.ts +314 -41
- package/dist_ts/data/secretbundle.d.ts +0 -57
- package/dist_ts/data/secretbundle.js +0 -2
- package/dist_ts/data/secretgroup.d.ts +0 -52
- package/dist_ts/data/secretgroup.js +0 -2
- package/dist_ts/requests/secretbundle.d.ts +0 -75
- package/dist_ts/requests/secretbundle.js +0 -4
- package/dist_ts/requests/secretgroup.d.ts +0 -52
- package/dist_ts/requests/secretgroup.js +0 -4
- package/ts/data/secretbundle.ts +0 -65
- package/ts/data/secretgroup.ts +0 -58
- package/ts/requests/secretbundle.ts +0 -103
- package/ts/requests/secretgroup.ts +0 -74
package/dist_ts/data/secret.js
CHANGED
|
@@ -1,11 +1,22 @@
|
|
|
1
|
+
import * as plugins from '../plugins.js';
|
|
1
2
|
import { normalizeServiceAbsolutePath } from './service.js';
|
|
2
3
|
/** Retired versions remain usable only through an already-accepted manifest. */
|
|
3
|
-
export const isSecretVersionMaterialIssuable = (lifecycleStateArg) => lifecycleStateArg === 'active'
|
|
4
|
+
export const isSecretVersionMaterialIssuable = (lifecycleStateArg, referencedByAcceptedManifestArg) => lifecycleStateArg === 'active'
|
|
5
|
+
|| (lifecycleStateArg === 'retired' && referencedByAcceptedManifestArg);
|
|
6
|
+
export const secretValueLimits = Object.freeze({
|
|
7
|
+
maximumBytes: 500 * 1024,
|
|
8
|
+
minimumGeneratedBytes: 16,
|
|
9
|
+
maximumGeneratedBytes: 64,
|
|
10
|
+
});
|
|
4
11
|
export const resolvedSecretManifestReferencesEqual = (leftArg, rightArg) => (Boolean(leftArg)
|
|
5
12
|
&& Boolean(rightArg)
|
|
6
13
|
&& leftArg?.manifestId === rightArg?.manifestId
|
|
7
14
|
&& leftArg?.manifestDigest === rightArg?.manifestDigest
|
|
8
15
|
&& leftArg?.clusterId === rightArg?.clusterId
|
|
16
|
+
&& leftArg?.imageRolloutId === rightArg?.imageRolloutId
|
|
17
|
+
&& leftArg?.imageRolloutGeneration === rightArg?.imageRolloutGeneration
|
|
18
|
+
&& leftArg?.requestedImageDigest === rightArg?.requestedImageDigest
|
|
19
|
+
&& leftArg?.invocationDigest === rightArg?.invocationDigest
|
|
9
20
|
&& leftArg?.secretRolloutId === rightArg?.secretRolloutId
|
|
10
21
|
&& leftArg?.secretRolloutGeneration === rightArg?.secretRolloutGeneration);
|
|
11
22
|
export const isResolvedSecretManifestReferenceAccepted = (stateArg, referenceArg, nowArg) => (resolvedSecretManifestReferencesEqual(stateArg.desiredManifest, referenceArg)
|
|
@@ -19,20 +30,42 @@ const secretKeyRegex = /^[A-Z_][A-Z0-9_]{0,252}$/;
|
|
|
19
30
|
const secretDigestRegex = /^sha256:[a-f0-9]{64}$/;
|
|
20
31
|
const secretManagementScopeRegex = /^(appstore|mail|oidc|webpush|platform|system):[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
|
|
21
32
|
const isRecord = (valueArg) => (Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg));
|
|
33
|
+
const hasExactKeys = (valueArg, keysArg) => {
|
|
34
|
+
const actual = Object.keys(valueArg).sort();
|
|
35
|
+
const expected = [...keysArg].sort();
|
|
36
|
+
return JSON.stringify(actual) === JSON.stringify(expected);
|
|
37
|
+
};
|
|
38
|
+
const hasOnlyKeys = (valueArg, keysArg) => Object.keys(valueArg).every((keyArg) => keysArg.includes(keyArg));
|
|
22
39
|
const isSecretIdentifier = (valueArg) => (typeof valueArg === 'string' && secretIdentifierRegex.test(valueArg));
|
|
23
40
|
const isSecretKey = (valueArg) => (typeof valueArg === 'string' && secretKeyRegex.test(valueArg));
|
|
24
41
|
const isSecretEnvironment = (valueArg) => (typeof valueArg === 'string' && secretEnvironmentRegex.test(valueArg));
|
|
42
|
+
export const validateSecretMutationId = (mutationIdArg) => (isSecretIdentifier(mutationIdArg)
|
|
43
|
+
? []
|
|
44
|
+
: ['mutationId must be a canonical identifier']);
|
|
45
|
+
export const validateSecretOwner = (ownerArg) => {
|
|
46
|
+
if (!isRecord(ownerArg))
|
|
47
|
+
return ['secret owner must be an object'];
|
|
48
|
+
const shapeByKind = {
|
|
49
|
+
service: ['kind', 'serviceId'],
|
|
50
|
+
'secret-set': ['kind', 'secretSetId'],
|
|
51
|
+
'platform-provider': ['kind', 'providerConfigId'],
|
|
52
|
+
system: ['kind', 'systemId'],
|
|
53
|
+
};
|
|
54
|
+
const keys = shapeByKind[ownerArg.kind];
|
|
55
|
+
if (!keys || !hasExactKeys(ownerArg, [...keys])) {
|
|
56
|
+
return ['secret owner must use an exact supported owner schema'];
|
|
57
|
+
}
|
|
58
|
+
const idField = keys[1];
|
|
59
|
+
return isSecretIdentifier(ownerArg[idField])
|
|
60
|
+
? []
|
|
61
|
+
: [`secret owner ${idField} must be canonical`];
|
|
62
|
+
};
|
|
25
63
|
export const validateSecretManagementScope = (sourceArg, scopeArg) => {
|
|
26
64
|
if (scopeArg === 'operator') {
|
|
27
65
|
return sourceArg === 'operator'
|
|
28
66
|
? []
|
|
29
67
|
: ['operator management scope requires operator source'];
|
|
30
68
|
}
|
|
31
|
-
if (scopeArg === 'legacy') {
|
|
32
|
-
return sourceArg === 'legacy'
|
|
33
|
-
? []
|
|
34
|
-
: ['legacy management scope requires legacy source'];
|
|
35
|
-
}
|
|
36
69
|
if (typeof scopeArg !== 'string' || !secretManagementScopeRegex.test(scopeArg)) {
|
|
37
70
|
return ['management scope must be canonical'];
|
|
38
71
|
}
|
|
@@ -43,19 +76,23 @@ export const validateSecretManagementScope = (sourceArg, scopeArg) => {
|
|
|
43
76
|
export const validateSecretDelivery = (deliveryArg) => {
|
|
44
77
|
if (!isRecord(deliveryArg))
|
|
45
78
|
return ['delivery must be an object'];
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
: ['environment delivery variableName must be a canonical environment key'];
|
|
79
|
+
const isLauncher = deliveryArg.type === 'launcher-environment';
|
|
80
|
+
if (!isLauncher && deliveryArg.type !== 'file') {
|
|
81
|
+
return ['delivery type must be launcher-environment or file'];
|
|
50
82
|
}
|
|
51
|
-
|
|
52
|
-
|
|
83
|
+
const expectedKeys = isLauncher
|
|
84
|
+
? ['type', 'variableName', 'uid', 'gid', 'mode']
|
|
85
|
+
: ['type', 'targetPath', 'uid', 'gid', 'mode'];
|
|
86
|
+
if (!hasExactKeys(deliveryArg, expectedKeys)) {
|
|
87
|
+
return ['delivery must use its exact schema'];
|
|
53
88
|
}
|
|
54
89
|
const errors = [];
|
|
55
|
-
if (
|
|
90
|
+
if (isLauncher && !isSecretKey(deliveryArg.variableName)) {
|
|
91
|
+
errors.push('launcher delivery variableName must be a canonical environment key');
|
|
92
|
+
}
|
|
93
|
+
if (!isLauncher && (typeof deliveryArg.targetPath !== 'string'
|
|
56
94
|
|| normalizeServiceAbsolutePath(deliveryArg.targetPath) !== deliveryArg.targetPath
|
|
57
|
-
|| !/^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(deliveryArg.targetPath)
|
|
58
|
-
|| deliveryArg.targetPath === '/run/secrets/secret.json') {
|
|
95
|
+
|| !/^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(deliveryArg.targetPath))) {
|
|
59
96
|
errors.push('file delivery targetPath must be a canonical file below /run/secrets');
|
|
60
97
|
}
|
|
61
98
|
for (const field of ['uid', 'gid']) {
|
|
@@ -63,14 +100,91 @@ export const validateSecretDelivery = (deliveryArg) => {
|
|
|
63
100
|
if (!Number.isSafeInteger(value)
|
|
64
101
|
|| value < 0
|
|
65
102
|
|| value > 2_147_483_647) {
|
|
66
|
-
errors.push(
|
|
103
|
+
errors.push(`${isLauncher ? 'launcher' : 'file'} delivery ${field} must be a bounded numeric identity`);
|
|
67
104
|
}
|
|
68
105
|
}
|
|
69
106
|
if (deliveryArg.mode !== 0o400 && deliveryArg.mode !== 0o440) {
|
|
70
|
-
errors.push('file delivery mode must be 0400 or 0440
|
|
107
|
+
errors.push(`${isLauncher ? 'launcher' : 'file'} delivery mode must be 0400 or 0440`);
|
|
71
108
|
}
|
|
72
109
|
return errors;
|
|
73
110
|
};
|
|
111
|
+
export const validateSecretValueInput = (valueInputArg) => {
|
|
112
|
+
if (!isRecord(valueInputArg))
|
|
113
|
+
return ['valueInput must be an object'];
|
|
114
|
+
if (valueInputArg.mode === 'sealed') {
|
|
115
|
+
if (!hasExactKeys(valueInputArg, ['mode', 'envelope'])) {
|
|
116
|
+
return ['sealed valueInput must use its exact schema'];
|
|
117
|
+
}
|
|
118
|
+
try {
|
|
119
|
+
const envelope = plugins.smartcrypto.parseX25519Envelope(valueInputArg.envelope);
|
|
120
|
+
return envelope.ciphertext.length
|
|
121
|
+
<= Math.ceil(secretValueLimits.maximumBytes * 4 / 3)
|
|
122
|
+
? []
|
|
123
|
+
: [`sealed secret material must not exceed ${secretValueLimits.maximumBytes} bytes`];
|
|
124
|
+
}
|
|
125
|
+
catch {
|
|
126
|
+
return ['sealed valueInput envelope must be a strict X25519 envelope'];
|
|
127
|
+
}
|
|
128
|
+
}
|
|
129
|
+
if (valueInputArg.mode === 'generated') {
|
|
130
|
+
if (!hasExactKeys(valueInputArg, ['mode', 'encoding', 'bytes'])) {
|
|
131
|
+
return ['generated valueInput must use its exact schema'];
|
|
132
|
+
}
|
|
133
|
+
const errors = [];
|
|
134
|
+
if (valueInputArg.encoding !== 'hex' && valueInputArg.encoding !== 'base64url') {
|
|
135
|
+
errors.push('generated valueInput encoding must be hex or base64url');
|
|
136
|
+
}
|
|
137
|
+
if (!Number.isSafeInteger(valueInputArg.bytes)
|
|
138
|
+
|| valueInputArg.bytes < secretValueLimits.minimumGeneratedBytes
|
|
139
|
+
|| valueInputArg.bytes > secretValueLimits.maximumGeneratedBytes) {
|
|
140
|
+
errors.push('generated valueInput bytes are outside the supported bounds');
|
|
141
|
+
}
|
|
142
|
+
return errors;
|
|
143
|
+
}
|
|
144
|
+
return ['valueInput mode must be sealed or generated'];
|
|
145
|
+
};
|
|
146
|
+
const encodeBase64Url = (bytesArg) => {
|
|
147
|
+
let binary = '';
|
|
148
|
+
for (const byte of bytesArg)
|
|
149
|
+
binary += String.fromCharCode(byte);
|
|
150
|
+
return globalThis.btoa(binary)
|
|
151
|
+
.replace(/\+/g, '-')
|
|
152
|
+
.replace(/\//g, '_')
|
|
153
|
+
.replace(/=+$/, '');
|
|
154
|
+
};
|
|
155
|
+
/** Checks the SmartCrypto context digest without opening or decrypting the envelope. */
|
|
156
|
+
export const verifySecretEnvelopeContext = async (envelopeArg, contextArg) => {
|
|
157
|
+
if (!(contextArg instanceof Uint8Array))
|
|
158
|
+
return false;
|
|
159
|
+
let envelope;
|
|
160
|
+
try {
|
|
161
|
+
envelope = plugins.smartcrypto.parseX25519Envelope(envelopeArg);
|
|
162
|
+
}
|
|
163
|
+
catch {
|
|
164
|
+
return false;
|
|
165
|
+
}
|
|
166
|
+
const contextDigest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new Uint8Array(contextArg)));
|
|
167
|
+
return envelope.contextDigest === encodeBase64Url(contextDigest);
|
|
168
|
+
};
|
|
169
|
+
/** Files accept arbitrary bytes; launcher values must be valid UTF-8 without NUL. */
|
|
170
|
+
export const validateSecretValueBytes = (valueBytesArg, deliveryArg) => {
|
|
171
|
+
if (!(valueBytesArg instanceof Uint8Array))
|
|
172
|
+
return ['secret material must be bytes'];
|
|
173
|
+
if (valueBytesArg.byteLength > secretValueLimits.maximumBytes) {
|
|
174
|
+
return [`secret material must not exceed ${secretValueLimits.maximumBytes} bytes`];
|
|
175
|
+
}
|
|
176
|
+
if (deliveryArg.type === 'file')
|
|
177
|
+
return [];
|
|
178
|
+
try {
|
|
179
|
+
const decoded = new TextDecoder('utf-8', { fatal: true }).decode(valueBytesArg);
|
|
180
|
+
return decoded.includes('\0')
|
|
181
|
+
? ['launcher secret material must not contain NUL']
|
|
182
|
+
: [];
|
|
183
|
+
}
|
|
184
|
+
catch {
|
|
185
|
+
return ['launcher secret material must be valid UTF-8'];
|
|
186
|
+
}
|
|
187
|
+
};
|
|
74
188
|
/**
|
|
75
189
|
* One shared precedence rule for resolution and runtime verification.
|
|
76
190
|
* A manifest is authoritative once published; before publication an attachment
|
|
@@ -83,16 +197,26 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
|
|
|
83
197
|
if (!isRecord(configurationArg)) {
|
|
84
198
|
return ['secretConfiguration must be an object'];
|
|
85
199
|
}
|
|
86
|
-
|
|
87
|
-
|
|
200
|
+
const errors = [];
|
|
201
|
+
if (!hasExactKeys(configurationArg, [
|
|
202
|
+
'schemaVersion',
|
|
203
|
+
'revision',
|
|
204
|
+
'secretsRevision',
|
|
205
|
+
'secretSetAttachments',
|
|
206
|
+
])) {
|
|
207
|
+
errors.push('secretConfiguration must use its exact schema');
|
|
208
|
+
}
|
|
209
|
+
if (configurationArg.schemaVersion !== 2) {
|
|
210
|
+
errors.push('secretConfiguration schemaVersion must be 2');
|
|
88
211
|
}
|
|
89
212
|
if (!Array.isArray(configurationArg.secretSetAttachments)) {
|
|
90
|
-
|
|
213
|
+
errors.push('secretSetAttachments must be an array');
|
|
214
|
+
return errors;
|
|
91
215
|
}
|
|
92
216
|
if (configurationArg.secretSetAttachments.length > 64) {
|
|
93
|
-
|
|
217
|
+
errors.push('secretSetAttachments must contain at most 64 entries');
|
|
218
|
+
return errors;
|
|
94
219
|
}
|
|
95
|
-
const errors = [];
|
|
96
220
|
if (!Number.isSafeInteger(configurationArg.revision)
|
|
97
221
|
|| configurationArg.revision < 0) {
|
|
98
222
|
errors.push('secretConfiguration revision must be a non-negative integer');
|
|
@@ -108,6 +232,9 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
|
|
|
108
232
|
errors.push(`secretSetAttachments[${attachmentIndex}] must be an object`);
|
|
109
233
|
continue;
|
|
110
234
|
}
|
|
235
|
+
if (!hasOnlyKeys(candidate, ['id', 'secretSetId', 'environment', 'mappings'])) {
|
|
236
|
+
errors.push(`secretSetAttachments[${attachmentIndex}] contains unsupported fields`);
|
|
237
|
+
}
|
|
111
238
|
if (!isSecretIdentifier(candidate.id)) {
|
|
112
239
|
errors.push(`secretSetAttachments[${attachmentIndex}].id must be a canonical identifier`);
|
|
113
240
|
}
|
|
@@ -137,6 +264,9 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
|
|
|
137
264
|
errors.push(`secretSetAttachments[${attachmentIndex}].mappings[${mappingIndex}] must be an object`);
|
|
138
265
|
continue;
|
|
139
266
|
}
|
|
267
|
+
if (!hasOnlyKeys(mappingCandidate, ['sourceKey', 'targetKey', 'delivery'])) {
|
|
268
|
+
errors.push(`secretSetAttachments[${attachmentIndex}].mappings[${mappingIndex}] contains unsupported fields`);
|
|
269
|
+
}
|
|
140
270
|
if (!isSecretKey(mappingCandidate.sourceKey)) {
|
|
141
271
|
errors.push(`secretSetAttachments[${attachmentIndex}].mappings[${mappingIndex}].sourceKey must be canonical`);
|
|
142
272
|
}
|
|
@@ -169,21 +299,6 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
|
|
|
169
299
|
}
|
|
170
300
|
return errors;
|
|
171
301
|
};
|
|
172
|
-
export const validateServiceSecretMode = (serviceDataArg) => {
|
|
173
|
-
if (!isRecord(serviceDataArg))
|
|
174
|
-
return ['service data must be an object'];
|
|
175
|
-
const hasLegacyPrimary = typeof serviceDataArg.secretBundleId === 'string'
|
|
176
|
-
&& serviceDataArg.secretBundleId.length > 0;
|
|
177
|
-
const hasLegacyAdditional = Array.isArray(serviceDataArg.additionalSecretBundleIds)
|
|
178
|
-
&& serviceDataArg.additionalSecretBundleIds.length > 0;
|
|
179
|
-
if (serviceDataArg.secretConfiguration !== undefined
|
|
180
|
-
&& (hasLegacyPrimary || hasLegacyAdditional)) {
|
|
181
|
-
return ['legacy SecretBundle references cannot be mixed with secretConfiguration'];
|
|
182
|
-
}
|
|
183
|
-
return serviceDataArg.secretConfiguration === undefined
|
|
184
|
-
? []
|
|
185
|
-
: validateServiceSecretConfiguration(serviceDataArg.secretConfiguration);
|
|
186
|
-
};
|
|
187
302
|
export const validateSecretSetAttachmentOwnership = (configurationArg, serviceOrganizationIdArg, secretSetsArg) => {
|
|
188
303
|
const errors = validateServiceSecretConfiguration(configurationArg);
|
|
189
304
|
const secretSetsById = new Map(secretSetsArg.map((secretSetArg) => [
|
|
@@ -210,6 +325,10 @@ export const createResolvedSecretManifestDigestInput = (manifestArg) => JSON.str
|
|
|
210
325
|
organizationId: manifestArg.organizationId,
|
|
211
326
|
serviceId: manifestArg.serviceId,
|
|
212
327
|
clusterId: manifestArg.clusterId,
|
|
328
|
+
imageRolloutId: manifestArg.imageRolloutId,
|
|
329
|
+
imageRolloutGeneration: manifestArg.imageRolloutGeneration,
|
|
330
|
+
requestedImageDigest: manifestArg.requestedImageDigest,
|
|
331
|
+
invocationDigest: manifestArg.invocationDigest,
|
|
213
332
|
secretRolloutId: manifestArg.secretRolloutId,
|
|
214
333
|
secretRolloutGeneration: manifestArg.secretRolloutGeneration,
|
|
215
334
|
entries: manifestArg.entries.map((entryArg) => ({
|
|
@@ -226,10 +345,13 @@ export const createResolvedSecretManifestDigestInput = (manifestArg) => JSON.str
|
|
|
226
345
|
kind: 'secret-set',
|
|
227
346
|
secretSetId: entryArg.owner.secretSetId,
|
|
228
347
|
},
|
|
229
|
-
delivery: entryArg.delivery.type === 'environment'
|
|
348
|
+
delivery: entryArg.delivery.type === 'launcher-environment'
|
|
230
349
|
? {
|
|
231
|
-
type: 'environment',
|
|
350
|
+
type: 'launcher-environment',
|
|
232
351
|
variableName: entryArg.delivery.variableName,
|
|
352
|
+
uid: entryArg.delivery.uid,
|
|
353
|
+
gid: entryArg.delivery.gid,
|
|
354
|
+
mode: entryArg.delivery.mode,
|
|
233
355
|
}
|
|
234
356
|
: {
|
|
235
357
|
type: 'file',
|
|
@@ -255,13 +377,32 @@ export const validateResolvedSecretManifest = (manifestArg) => {
|
|
|
255
377
|
if (!isRecord(manifestArg))
|
|
256
378
|
return ['secret manifest must be an object'];
|
|
257
379
|
const errors = [];
|
|
258
|
-
if (manifestArg
|
|
259
|
-
|
|
380
|
+
if (!hasExactKeys(manifestArg, [
|
|
381
|
+
'schemaVersion',
|
|
382
|
+
'id',
|
|
383
|
+
'digest',
|
|
384
|
+
'organizationId',
|
|
385
|
+
'serviceId',
|
|
386
|
+
'clusterId',
|
|
387
|
+
'imageRolloutId',
|
|
388
|
+
'imageRolloutGeneration',
|
|
389
|
+
'requestedImageDigest',
|
|
390
|
+
'invocationDigest',
|
|
391
|
+
'secretRolloutId',
|
|
392
|
+
'secretRolloutGeneration',
|
|
393
|
+
'entries',
|
|
394
|
+
'createdAt',
|
|
395
|
+
])) {
|
|
396
|
+
errors.push('secret manifest must use its exact schema');
|
|
397
|
+
}
|
|
398
|
+
if (manifestArg.schemaVersion !== 2)
|
|
399
|
+
errors.push('secret manifest schemaVersion must be 2');
|
|
260
400
|
for (const field of [
|
|
261
401
|
'id',
|
|
262
402
|
'organizationId',
|
|
263
403
|
'serviceId',
|
|
264
404
|
'clusterId',
|
|
405
|
+
'imageRolloutId',
|
|
265
406
|
'secretRolloutId',
|
|
266
407
|
]) {
|
|
267
408
|
if (!isSecretIdentifier(manifestArg[field])) {
|
|
@@ -271,6 +412,15 @@ export const validateResolvedSecretManifest = (manifestArg) => {
|
|
|
271
412
|
if (typeof manifestArg.digest !== 'string' || !secretDigestRegex.test(manifestArg.digest)) {
|
|
272
413
|
errors.push('secret manifest digest must be a canonical sha256 digest');
|
|
273
414
|
}
|
|
415
|
+
for (const field of ['requestedImageDigest', 'invocationDigest']) {
|
|
416
|
+
if (typeof manifestArg[field] !== 'string' || !secretDigestRegex.test(manifestArg[field])) {
|
|
417
|
+
errors.push(`secret manifest ${field} must be a canonical sha256 digest`);
|
|
418
|
+
}
|
|
419
|
+
}
|
|
420
|
+
if (!Number.isSafeInteger(manifestArg.imageRolloutGeneration)
|
|
421
|
+
|| manifestArg.imageRolloutGeneration < 1) {
|
|
422
|
+
errors.push('secret manifest image rollout generation must be a positive integer');
|
|
423
|
+
}
|
|
274
424
|
if (!Number.isSafeInteger(manifestArg.secretRolloutGeneration)
|
|
275
425
|
|| manifestArg.secretRolloutGeneration < 1) {
|
|
276
426
|
errors.push('secret manifest rollout generation must be a positive integer');
|
|
@@ -293,6 +443,16 @@ export const validateResolvedSecretManifest = (manifestArg) => {
|
|
|
293
443
|
errors.push(`secret manifest entries[${index}] must be an object`);
|
|
294
444
|
continue;
|
|
295
445
|
}
|
|
446
|
+
if (!hasExactKeys(candidate, [
|
|
447
|
+
'secretId',
|
|
448
|
+
'secretVersionId',
|
|
449
|
+
'key',
|
|
450
|
+
'environment',
|
|
451
|
+
'owner',
|
|
452
|
+
'delivery',
|
|
453
|
+
])) {
|
|
454
|
+
errors.push(`secret manifest entries[${index}] must use its exact schema`);
|
|
455
|
+
}
|
|
296
456
|
if (!isSecretIdentifier(candidate.secretId)) {
|
|
297
457
|
errors.push(`secret manifest entries[${index}].secretId must be canonical`);
|
|
298
458
|
}
|
|
@@ -317,6 +477,9 @@ export const validateResolvedSecretManifest = (manifestArg) => {
|
|
|
317
477
|
if (!isRecord(candidate.owner)
|
|
318
478
|
|| (candidate.owner.kind !== 'service'
|
|
319
479
|
&& candidate.owner.kind !== 'secret-set')
|
|
480
|
+
|| !hasExactKeys(candidate.owner, candidate.owner.kind === 'service'
|
|
481
|
+
? ['kind', 'serviceId']
|
|
482
|
+
: ['kind', 'secretSetId'])
|
|
320
483
|
|| (candidate.owner.kind === 'service'
|
|
321
484
|
&& !isSecretIdentifier(candidate.owner.serviceId))
|
|
322
485
|
|| (candidate.owner.kind === 'secret-set'
|
|
@@ -330,7 +493,7 @@ export const validateResolvedSecretManifest = (manifestArg) => {
|
|
|
330
493
|
}
|
|
331
494
|
errors.push(...validateSecretDelivery(candidate.delivery).map((errorArg) => `secret manifest entries[${index}].${errorArg}`));
|
|
332
495
|
if (isRecord(candidate.delivery)) {
|
|
333
|
-
if (candidate.delivery.type === 'environment'
|
|
496
|
+
if (candidate.delivery.type === 'launcher-environment'
|
|
334
497
|
&& isSecretKey(candidate.delivery.variableName)) {
|
|
335
498
|
environmentDeliveryTargets.push(candidate.delivery.variableName);
|
|
336
499
|
}
|
|
@@ -367,10 +530,28 @@ export const validateResolvedSecretManifest = (manifestArg) => {
|
|
|
367
530
|
};
|
|
368
531
|
const validateResolvedSecretManifestReference = (referenceArg, expectedClusterIdArg, pathArg) => {
|
|
369
532
|
if (!isRecord(referenceArg)
|
|
533
|
+
|| !hasExactKeys(referenceArg, [
|
|
534
|
+
'manifestId',
|
|
535
|
+
'manifestDigest',
|
|
536
|
+
'clusterId',
|
|
537
|
+
'imageRolloutId',
|
|
538
|
+
'imageRolloutGeneration',
|
|
539
|
+
'requestedImageDigest',
|
|
540
|
+
'invocationDigest',
|
|
541
|
+
'secretRolloutId',
|
|
542
|
+
'secretRolloutGeneration',
|
|
543
|
+
])
|
|
370
544
|
|| !isSecretIdentifier(referenceArg.manifestId)
|
|
371
545
|
|| typeof referenceArg.manifestDigest !== 'string'
|
|
372
546
|
|| !secretDigestRegex.test(referenceArg.manifestDigest)
|
|
373
547
|
|| referenceArg.clusterId !== expectedClusterIdArg
|
|
548
|
+
|| !isSecretIdentifier(referenceArg.imageRolloutId)
|
|
549
|
+
|| !Number.isSafeInteger(referenceArg.imageRolloutGeneration)
|
|
550
|
+
|| referenceArg.imageRolloutGeneration < 1
|
|
551
|
+
|| typeof referenceArg.requestedImageDigest !== 'string'
|
|
552
|
+
|| !secretDigestRegex.test(referenceArg.requestedImageDigest)
|
|
553
|
+
|| typeof referenceArg.invocationDigest !== 'string'
|
|
554
|
+
|| !secretDigestRegex.test(referenceArg.invocationDigest)
|
|
374
555
|
|| !isSecretIdentifier(referenceArg.secretRolloutId)
|
|
375
556
|
|| !Number.isSafeInteger(referenceArg.secretRolloutGeneration)
|
|
376
557
|
|| referenceArg.secretRolloutGeneration < 1) {
|
|
@@ -382,8 +563,16 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
|
|
|
382
563
|
if (!isRecord(planArg))
|
|
383
564
|
return ['secret deployment plan must be an object'];
|
|
384
565
|
const errors = [];
|
|
385
|
-
if (planArg
|
|
386
|
-
|
|
566
|
+
if (!hasExactKeys(planArg, [
|
|
567
|
+
'schemaVersion',
|
|
568
|
+
'revision',
|
|
569
|
+
'clusterStates',
|
|
570
|
+
'updatedAt',
|
|
571
|
+
])) {
|
|
572
|
+
errors.push('secret deployment plan must use its exact schema');
|
|
573
|
+
}
|
|
574
|
+
if (planArg.schemaVersion !== 2)
|
|
575
|
+
errors.push('secret deployment plan schemaVersion must be 2');
|
|
387
576
|
if (!Number.isSafeInteger(planArg.revision) || planArg.revision < 1) {
|
|
388
577
|
errors.push('secret deployment plan revision must be a positive integer');
|
|
389
578
|
}
|
|
@@ -418,6 +607,16 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
|
|
|
418
607
|
errors.push(`${path}.clusterId must be canonical`);
|
|
419
608
|
continue;
|
|
420
609
|
}
|
|
610
|
+
if (!hasOnlyKeys(candidate, [
|
|
611
|
+
'clusterId',
|
|
612
|
+
'desiredManifest',
|
|
613
|
+
'appliedManifest',
|
|
614
|
+
'previousAcceptedManifest',
|
|
615
|
+
'status',
|
|
616
|
+
'updatedAt',
|
|
617
|
+
])) {
|
|
618
|
+
errors.push(`${path} contains unsupported fields`);
|
|
619
|
+
}
|
|
421
620
|
clusterIds.push(candidate.clusterId);
|
|
422
621
|
validateAndTrackManifestReference(candidate.desiredManifest, candidate.clusterId, `${path}.desiredManifest`);
|
|
423
622
|
if (candidate.appliedManifest !== undefined) {
|
|
@@ -425,6 +624,7 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
|
|
|
425
624
|
}
|
|
426
625
|
if (candidate.previousAcceptedManifest !== undefined) {
|
|
427
626
|
if (!isRecord(candidate.previousAcceptedManifest)
|
|
627
|
+
|| !hasExactKeys(candidate.previousAcceptedManifest, ['manifest', 'acceptedUntil'])
|
|
428
628
|
|| !Number.isSafeInteger(candidate.previousAcceptedManifest.acceptedUntil)
|
|
429
629
|
|| candidate.previousAcceptedManifest.acceptedUntil < 0) {
|
|
430
630
|
errors.push(`${path}.previousAcceptedManifest acceptedUntil must be non-negative`);
|
|
@@ -466,4 +666,302 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
|
|
|
466
666
|
}
|
|
467
667
|
return errors;
|
|
468
668
|
};
|
|
469
|
-
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9zZWNyZXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBZ0I1RCxnRkFBZ0Y7QUFDaEYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsaUJBQStDLEVBQ3RDLEVBQUUsQ0FBQyxpQkFBaUIsS0FBSyxRQUFRLElBQUksaUJBQWlCLEtBQUssU0FBUyxDQUFDO0FBeU9oRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxDQUNuRCxPQUFxRCxFQUNyRCxRQUFzRCxFQUM3QyxFQUFFLENBQUMsQ0FDWixPQUFPLENBQUMsT0FBTyxDQUFDO09BQ2IsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUNqQixPQUFPLEVBQUUsVUFBVSxLQUFLLFFBQVEsRUFBRSxVQUFVO09BQzVDLE9BQU8sRUFBRSxjQUFjLEtBQUssUUFBUSxFQUFFLGNBQWM7T0FDcEQsT0FBTyxFQUFFLFNBQVMsS0FBSyxRQUFRLEVBQUUsU0FBUztPQUMxQyxPQUFPLEVBQUUsZUFBZSxLQUFLLFFBQVEsRUFBRSxlQUFlO09BQ3RELE9BQU8sRUFBRSx1QkFBdUIsS0FBSyxRQUFRLEVBQUUsdUJBQXVCLENBQzFFLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxRQUF1QyxFQUN2QyxZQUE4QyxFQUM5QyxNQUFjLEVBQ0wsRUFBRSxDQUFDLENBQ1oscUNBQXFDLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxZQUFZLENBQUM7T0FDMUUscUNBQXFDLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxZQUFZLENBQUM7T0FDN0UsQ0FDRCxPQUFPLENBQUMsUUFBUSxDQUFDLHdCQUF3QixDQUFDO1dBQ3ZDLE1BQU0sR0FBRyxRQUFRLENBQUMsd0JBQXlCLENBQUMsYUFBYTtXQUN6RCxxQ0FBcUMsQ0FDdEMsUUFBUSxDQUFDLHdCQUF5QixDQUFDLFFBQVEsRUFDM0MsWUFBWSxDQUNiLENBQ0YsQ0FDRixDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNwRSxNQUFNLHNCQUFzQixHQUFHLG1DQUFtQyxDQUFDO0FBQ25FLE1BQU0sY0FBYyxHQUFHLDBCQUEwQixDQUFDO0FBQ2xELE1BQU0saUJBQWlCLEdBQUcsdUJBQXVCLENBQUM7QUFDbEQsTUFBTSwwQkFBMEIsR0FDOUIsaUZBQWlGLENBQUM7QUFFcEYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQzlFLENBQUM7QUFFRixNQUFNLGtCQUFrQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3BFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3JFLENBQUM7QUFFRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM3RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDOUQsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDckUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDdEUsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQzNDLFNBQWtDLEVBQ2xDLFFBQWlCLEVBQ1AsRUFBRTtJQUNaLElBQUksUUFBUSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzVCLE9BQU8sU0FBUyxLQUFLLFVBQVU7WUFDN0IsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUMsQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMxQixPQUFPLFNBQVMsS0FBSyxRQUFRO1lBQzNCLENBQUMsQ0FBQyxFQUFFO1lBQ0osQ0FBQyxDQUFDLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMsb0NBQW9DLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsVUFBVSxDQUFDLEdBQUcsU0FBUyxHQUFHLENBQUM7UUFDekMsQ0FBQyxDQUFDLEVBQUU7UUFDSixDQUFDLENBQUMsQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0FBQy9ELENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsV0FBb0IsRUFBWSxFQUFFO0lBQ3ZFLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDbEUsSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sV0FBVyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUM7WUFDMUMsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUMsQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxJQUFJLFdBQVcsQ0FBQyxJQUFJLEtBQUssTUFBTSxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sV0FBVyxDQUFDLFVBQVUsS0FBSyxRQUFRO1dBQ3pDLDRCQUE0QixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxXQUFXLENBQUMsVUFBVTtXQUMvRSxDQUFDLG9EQUFvRCxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDO1dBQ2xGLFdBQVcsQ0FBQyxVQUFVLEtBQUssMEJBQTBCLEVBQUUsQ0FBQztRQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFVLEVBQUUsQ0FBQztRQUM1QyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO2VBQzFCLEtBQWdCLEdBQUcsQ0FBQztlQUNwQixLQUFnQixHQUFHLGFBQWEsRUFBRSxDQUFDO1lBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEtBQUsscUNBQXFDLENBQUMsQ0FBQztRQUMzRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUM3RCxNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFdBSXJDLEVBQW1CLEVBQUUsQ0FBQyxDQUNyQixXQUFXLENBQUMsZ0JBQWdCO09BQ3pCLFdBQVcsQ0FBQyxrQkFBa0I7T0FDOUIsV0FBVyxDQUFDLGFBQWEsQ0FDN0IsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELGdCQUF5QixFQUNmLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNoQyxPQUFPLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekMsT0FBTyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLEVBQUUsQ0FBQztRQUMxRCxPQUFPLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxNQUFNLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDdEQsT0FBTyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUM7V0FDOUMsZ0JBQWdCLENBQUMsUUFBbUIsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMvQyxNQUFNLENBQUMsSUFBSSxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGdCQUFnQixDQUFDLGVBQWUsQ0FBQztXQUNyRCxnQkFBZ0IsQ0FBQyxlQUEwQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQWEsRUFBRSxDQUFDO0lBQ25DLE1BQU0sa0JBQWtCLEdBQWEsRUFBRSxDQUFDO0lBQ3hDLEtBQUssTUFBTSxDQUFDLGVBQWUsRUFBRSxTQUFTLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQzNGLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN6QixNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLHFCQUFxQixDQUFDLENBQUM7WUFDMUUsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDdEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsZUFBZSxxQ0FBcUMsQ0FBQyxDQUFDO1FBQzVGLENBQUM7YUFBTSxDQUFDO1lBQ04sYUFBYSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbkMsQ0FBQztRQUNELElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMvQyxNQUFNLENBQUMsSUFBSSxDQUNULHdCQUF3QixlQUFlLDhDQUE4QyxDQUN0RixDQUFDO1FBQ0osQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUNULHdCQUF3QixlQUFlLCtDQUErQyxDQUN2RixDQUFDO1FBQ0osQ0FBQztRQUNELElBQUksa0JBQWtCLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQztlQUN4QyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssU0FBUztZQUFFLFNBQVM7UUFDL0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1lBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUsb0NBQW9DLENBQUMsQ0FBQztZQUN6RixTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFhLEVBQUUsQ0FBQztRQUNoQyxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7UUFDaEMsS0FBSyxNQUFNLENBQUMsWUFBWSxFQUFFLGdCQUFnQixDQUFDLElBQUksU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQzVFLElBQUksQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO2dCQUNoQyxNQUFNLENBQUMsSUFBSSxDQUNULHdCQUF3QixlQUFlLGNBQWMsWUFBWSxxQkFBcUIsQ0FDdkYsQ0FBQztnQkFDRixTQUFTO1lBQ1gsQ0FBQztZQUNELElBQUksQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSxjQUFjLFlBQVksK0JBQStCLENBQ2pHLENBQUM7WUFDSixDQUFDO2lCQUFNLENBQUM7Z0JBQ04sVUFBVSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQ0QsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsU0FBUyxJQUFJLGdCQUFnQixDQUFDLFNBQVMsQ0FBQztZQUMxRSxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsd0JBQXdCLGVBQWUsY0FBYyxZQUFZLCtCQUErQixDQUNqRyxDQUFDO1lBQ0osQ0FBQztpQkFBTSxDQUFDO2dCQUNOLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDNUIsQ0FBQztZQUNELElBQUksZ0JBQWdCLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsc0JBQXNCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLENBQUMsR0FBRyxDQUNsRSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDWix3QkFBd0IsZUFBZSxjQUFjLFlBQVksS0FBSyxRQUFRLEVBQUUsQ0FDakYsQ0FDRixDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLElBQUksS0FBSyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUMsSUFBSSxLQUFLLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxjQUF1QixFQUFZLEVBQUU7SUFDN0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUM7UUFBRSxPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUN6RSxNQUFNLGdCQUFnQixHQUFHLE9BQU8sY0FBYyxDQUFDLGNBQWMsS0FBSyxRQUFRO1dBQ3JFLGNBQWMsQ0FBQyxjQUFjLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztJQUM5QyxNQUFNLG1CQUFtQixHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLHlCQUF5QixDQUFDO1dBQzlFLGNBQWMsQ0FBQyx5QkFBeUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO0lBQ3pELElBQUksY0FBYyxDQUFDLG1CQUFtQixLQUFLLFNBQVM7V0FDL0MsQ0FBQyxnQkFBZ0IsSUFBSSxtQkFBbUIsQ0FBQyxFQUFFLENBQUM7UUFDL0MsT0FBTyxDQUFDLHlFQUF5RSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE9BQU8sY0FBYyxDQUFDLG1CQUFtQixLQUFLLFNBQVM7UUFDckQsQ0FBQyxDQUFDLEVBQUU7UUFDSixDQUFDLENBQUMsa0NBQWtDLENBQUMsY0FBYyxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFDN0UsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsZ0JBQTZDLEVBQzdDLHdCQUFnQyxFQUNoQyxhQUFtQyxFQUN6QixFQUFFO0lBQ1osTUFBTSxNQUFNLEdBQUcsa0NBQWtDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUNwRSxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQztRQUNqRSxZQUFZLENBQUMsRUFBRTtRQUNmLFlBQVk7S0FDYixDQUFDLENBQUMsQ0FBQztJQUNKLEtBQUssTUFBTSxVQUFVLElBQUksZ0JBQWdCLENBQUMsb0JBQW9CLElBQUksRUFBRSxFQUFFLENBQUM7UUFDckUsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGlCQUFpQixDQUFDLENBQUM7UUFDcEUsQ0FBQzthQUFNLElBQUksU0FBUyxDQUFDLGNBQWMsS0FBSyx3QkFBd0IsRUFBRSxDQUFDO1lBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxVQUFVLENBQUMsV0FBVyxrQ0FBa0MsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7YUFBTSxJQUFJLFNBQVMsQ0FBQyxjQUFjLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGdCQUFnQixDQUFDLENBQUM7UUFDbkUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxXQUFvQyxFQUM1QixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixhQUFhLEVBQUUsV0FBVyxDQUFDLGFBQWE7SUFDeEMsRUFBRSxFQUFFLFdBQVcsQ0FBQyxFQUFFO0lBQ2xCLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztJQUMxQyxTQUFTLEVBQUUsV0FBVyxDQUFDLFNBQVM7SUFDaEMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO0lBQ2hDLGVBQWUsRUFBRSxXQUFXLENBQUMsZUFBZTtJQUM1Qyx1QkFBdUIsRUFBRSxXQUFXLENBQUMsdUJBQXVCO0lBQzVELE9BQU8sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5QyxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVE7UUFDM0IsZUFBZSxFQUFFLFFBQVEsQ0FBQyxlQUFlO1FBQ3pDLEdBQUcsRUFBRSxRQUFRLENBQUMsR0FBRztRQUNqQixXQUFXLEVBQUUsUUFBUSxDQUFDLFdBQVc7UUFDakMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVM7WUFDdEMsQ0FBQyxDQUFDO2dCQUNFLElBQUksRUFBRSxTQUFTO2dCQUNmLFNBQVMsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVM7YUFDcEM7WUFDSCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLFlBQVk7Z0JBQ2xCLFdBQVcsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFdBQVc7YUFDeEM7UUFDTCxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssYUFBYTtZQUNoRCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLGFBQWE7Z0JBQ25CLFlBQVksRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLFlBQVk7YUFDN0M7WUFDSCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLE1BQU07Z0JBQ1osVUFBVSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVTtnQkFDeEMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsSUFBSSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSTthQUM3QjtLQUNOLENBQUMsQ0FBQztJQUNILFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztDQUNqQyxDQUFDLENBQUM7QUFFSCxtRkFBbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsS0FBSyxFQUN0RCxXQUFvQyxFQUNaLEVBQUU7SUFDMUIsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsdUNBQXVDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMvRixNQUFNLFlBQVksR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDL0UsTUFBTSxTQUFTLEdBQUcsQ0FBQyxHQUFHLElBQUksVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO1NBQ2hELEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1NBQ3ZELElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNaLE9BQU8sVUFBVSxTQUFTLEVBQW1CLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsS0FBSyxFQUNyRCxXQUFvQyxFQUNsQixFQUFFLENBQUMsQ0FDckIsV0FBVyxDQUFDLE1BQU0sS0FBSyxNQUFNLG1DQUFtQyxDQUFDLFdBQVcsQ0FBQyxDQUM5RSxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsV0FBb0IsRUFDVixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7UUFBRSxPQUFPLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN6RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxXQUFXLENBQUMsYUFBYSxLQUFLLENBQUM7UUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDNUYsS0FBSyxNQUFNLEtBQUssSUFBSTtRQUNsQixJQUFJO1FBQ0osZ0JBQWdCO1FBQ2hCLFdBQVc7UUFDWCxXQUFXO1FBQ1gsaUJBQWlCO0tBQ1QsRUFBRSxDQUFDO1FBQ1gsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsS0FBSyxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLHVCQUF1QixDQUFDO1dBQ3hELFdBQVcsQ0FBQyx1QkFBa0MsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsSUFBSyxXQUFXLENBQUMsU0FBb0IsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRixNQUFNLENBQUMsSUFBSSxDQUFDLDBEQUEwRCxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsSUFBSSxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDL0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUMvQixNQUFNLFNBQVMsR0FBYSxFQUFFLENBQUM7SUFDL0IsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO0lBQ2hDLE1BQU0sMEJBQTBCLEdBQWEsRUFBRSxDQUFDO0lBQ2hELE1BQU0sbUJBQW1CLEdBQWEsRUFBRSxDQUFDO0lBQ3pDLElBQUksZUFBbUMsQ0FBQztJQUN4QyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQy9ELElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN6QixNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHFCQUFxQixDQUFDLENBQUM7WUFDbkUsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQzlFLENBQUM7YUFBTSxDQUFDO1lBQ04sU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDckMsQ0FBQztRQUNELElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHFDQUFxQyxDQUFDLENBQUM7UUFDckYsQ0FBQzthQUFNLENBQUM7WUFDTixVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHlCQUF5QixDQUFDLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLGlDQUFpQyxDQUFDLENBQUM7UUFDakYsQ0FBQzthQUFNLElBQUksV0FBVyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUM7ZUFDekIsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZLENBQ3pDO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQ2xEO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZO21CQUNsQyxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQ3RELEVBQUUsQ0FBQztZQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLEtBQUssMkJBQTJCLENBQUMsQ0FBQztRQUMzRSxDQUFDO2FBQU0sSUFDTCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO2VBQy9CLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7ZUFDekMsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVMsRUFDdEQsQ0FBQztZQUNELE1BQU0sQ0FBQyxJQUFJLENBQ1QsMkJBQTJCLEtBQUsscURBQXFELENBQ3RGLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxHQUFHLENBQzNELENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQywyQkFBMkIsS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUM5RCxDQUFDLENBQUM7UUFDSCxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqQyxJQUNFLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLGFBQWE7bUJBQ3RDLFdBQVcsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxFQUMvQyxDQUFDO2dCQUNELDBCQUEwQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQ25FLENBQUM7aUJBQU0sSUFDTCxTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksS0FBSyxNQUFNO21CQUMvQixPQUFPLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVE7bUJBQ2pELHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUMxRCxDQUFDO2dCQUNELG1CQUFtQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzFELENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxJQUFJLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQzdFLE1BQU0sT0FBTyxHQUFHLEdBQUcsU0FBUyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDN0QsSUFBSSxlQUFlLEtBQUssU0FBUyxJQUFJLE9BQU8sSUFBSSxlQUFlLEVBQUUsQ0FBQztnQkFDaEUsTUFBTSxDQUFDLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1lBQ3hGLENBQUM7WUFDRCxlQUFlLEdBQUcsT0FBTyxDQUFDO1FBQzVCLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLElBQUksS0FBSywwQkFBMEIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNuRixNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxJQUFJLEtBQUssbUJBQW1CLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckUsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLHVDQUF1QyxHQUFHLENBQzlDLFlBQXFCLEVBQ3JCLG9CQUE0QixFQUM1QixPQUFlLEVBQ0wsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDO1dBQ3RCLENBQUMsa0JBQWtCLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQztXQUM1QyxPQUFPLFlBQVksQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUMvQyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDO1dBQ3BELFlBQVksQ0FBQyxTQUFTLEtBQUssb0JBQW9CO1dBQy9DLENBQUMsa0JBQWtCLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQztXQUNqRCxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLHVCQUF1QixDQUFDO1dBQzFELFlBQVksQ0FBQyx1QkFBa0MsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRCxPQUFPLENBQUMsR0FBRyxPQUFPLDBDQUEwQyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE9BQU8sRUFBRSxDQUFDO0FBQ1osQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FDakQsT0FBZ0IsRUFDaEIsMkJBQXNDLEVBQzVCLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztRQUFFLE9BQU8sQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sQ0FBQyxhQUFhLEtBQUssQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUMvRixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUssT0FBTyxDQUFDLFFBQW1CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUssT0FBTyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1dBQ3BDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbEMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1FBQ3RGLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7SUFDaEMsTUFBTSxzQkFBc0IsR0FBRyxJQUFJLEdBQUcsRUFBNEMsQ0FBQztJQUNuRixNQUFNLGlDQUFpQyxHQUFHLENBQ3hDLFlBQXFCLEVBQ3JCLG9CQUE0QixFQUM1QixPQUFlLEVBQ1QsRUFBRTtRQUNSLE1BQU0sZUFBZSxHQUFHLHVDQUF1QyxDQUM3RCxZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLE9BQU8sQ0FDUixDQUFDO1FBQ0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUsQ0FBQyxDQUFDO1FBQ2hDLElBQUksZUFBZSxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQUUsT0FBTztRQUN2QyxNQUFNLFNBQVMsR0FBRyxZQUFnRCxDQUFDO1FBQ25FLE1BQU0saUJBQWlCLEdBQUcsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMzRSxJQUNFLGlCQUFpQjtlQUNkLENBQUMscUNBQXFDLENBQUMsaUJBQWlCLEVBQUUsU0FBUyxDQUFDLEVBQ3ZFLENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUNULEdBQUcsT0FBTyxnRkFBZ0YsQ0FDM0YsQ0FBQztZQUNGLE9BQU87UUFDVCxDQUFDO1FBQ0Qsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksR0FBRyx3Q0FBd0MsS0FBSyxHQUFHLENBQUM7UUFDOUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhCQUE4QixDQUFDLENBQUM7WUFDbkQsU0FBUztRQUNYLENBQUM7UUFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNyQyxpQ0FBaUMsQ0FDL0IsU0FBUyxDQUFDLGVBQWUsRUFDekIsU0FBUyxDQUFDLFNBQVMsRUFDbkIsR0FBRyxJQUFJLGtCQUFrQixDQUMxQixDQUFDO1FBQ0YsSUFBSSxTQUFTLENBQUMsZUFBZSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzVDLGlDQUFpQyxDQUMvQixTQUFTLENBQUMsZUFBZSxFQUN6QixTQUFTLENBQUMsU0FBUyxFQUNuQixHQUFHLElBQUksa0JBQWtCLENBQzFCLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxTQUFTLENBQUMsd0JBQXdCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDckQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7bUJBQzVDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUMsYUFBYSxDQUFDO21CQUN0RSxTQUFTLENBQUMsd0JBQXdCLENBQUMsYUFBd0IsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDdEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksOERBQThELENBQUMsQ0FBQztZQUNyRixDQUFDO2lCQUFNLENBQUM7Z0JBQ04saUNBQWlDLENBQy9CLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQzNDLFNBQVMsQ0FBQyxTQUFTLEVBQ25CLEdBQUcsSUFBSSxvQ0FBb0MsQ0FDNUMsQ0FBQztnQkFDRixJQUNFLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQzt1QkFDckMsU0FBUyxDQUFDLHdCQUF3QixDQUFDLGFBQXdCOzBCQUMxRCxTQUFTLENBQUMsU0FBb0IsRUFDbkMsQ0FBQztvQkFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSw0REFBNEQsQ0FBQyxDQUFDO2dCQUNuRixDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxTQUFTO1lBQ1QsVUFBVTtZQUNWLFNBQVM7WUFDVCxTQUFTO1lBQ1QsUUFBUTtTQUNULENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFnQixDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSwyQkFBMkIsQ0FBQyxDQUFDO1FBQ2xELENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUssU0FBUyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksMkNBQTJDLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsSUFDRSxTQUFTLENBQUMsTUFBTSxLQUFLLFNBQVM7ZUFDM0IsQ0FBQyxxQ0FBcUMsQ0FDdkMsU0FBUyxDQUFDLGVBQThELEVBQ3hFLFNBQVMsQ0FBQyxlQUE4RCxDQUN6RSxFQUNELENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSw2REFBNkQsQ0FBQyxDQUFDO1FBQ3BGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSwyQkFBMkIsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sUUFBUSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbEUsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxVQUFVLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUN4RSxNQUFNLENBQUMsSUFBSSxDQUFDLCtFQUErRSxDQUFDLENBQUM7UUFDL0YsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
|
|
669
|
+
export const dockerSecretResourceNameDomain = 'serve.zone/docker-secret-resource/v1';
|
|
670
|
+
export const workloadInitEnvironmentMapPath = '/run/serve.zone/workloadinit-map-v1.json';
|
|
671
|
+
export const workloadRuntimeAssetRoot = '/opt/serve.zone/runtime-assets';
|
|
672
|
+
export const workloadInitExecutablePath = '/opt/serve.zone/runtime-assets/workloadinit/v1/workloadinit';
|
|
673
|
+
export const workloadInitEnvironmentMapMode = 0o444;
|
|
674
|
+
export const workloadRuntimeAssetsReadOnly = true;
|
|
675
|
+
const encodeLowercaseBase32 = (bytesArg) => {
|
|
676
|
+
const alphabet = 'abcdefghijklmnopqrstuvwxyz234567';
|
|
677
|
+
let output = '';
|
|
678
|
+
let accumulator = 0;
|
|
679
|
+
let bitCount = 0;
|
|
680
|
+
for (const byte of bytesArg) {
|
|
681
|
+
accumulator = (accumulator << 8) | byte;
|
|
682
|
+
bitCount += 8;
|
|
683
|
+
while (bitCount >= 5) {
|
|
684
|
+
bitCount -= 5;
|
|
685
|
+
output += alphabet[(accumulator >>> bitCount) & 31];
|
|
686
|
+
}
|
|
687
|
+
accumulator &= (1 << bitCount) - 1;
|
|
688
|
+
}
|
|
689
|
+
if (bitCount > 0)
|
|
690
|
+
output += alphabet[(accumulator << (5 - bitCount)) & 31];
|
|
691
|
+
return output;
|
|
692
|
+
};
|
|
693
|
+
/** Stable resource name; no logical key or value material appears in Docker. */
|
|
694
|
+
export const createDockerSecretResourceName = async (secretVersionIdArg) => {
|
|
695
|
+
if (!isSecretIdentifier(secretVersionIdArg)) {
|
|
696
|
+
throw new Error('secretVersionId must be a canonical identifier');
|
|
697
|
+
}
|
|
698
|
+
const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(`${dockerSecretResourceNameDomain}\0${secretVersionIdArg}`)));
|
|
699
|
+
const encoded = encodeLowercaseBase32(digest);
|
|
700
|
+
if (encoded.length !== 52)
|
|
701
|
+
throw new Error('unexpected SHA-256 base32 length');
|
|
702
|
+
return `szsv-${encoded}`;
|
|
703
|
+
};
|
|
704
|
+
export const createLauncherSecretSourcePath = (resourceArg) => {
|
|
705
|
+
if (!/^szsv-[a-z2-7]{52}$/.test(resourceArg)) {
|
|
706
|
+
throw new Error('resource must be a canonical serve.zone secret resource name');
|
|
707
|
+
}
|
|
708
|
+
return `/run/serve.zone/secrets/${resourceArg}`;
|
|
709
|
+
};
|
|
710
|
+
/**
|
|
711
|
+
* The nonsecret map is generated only from launcher deliveries. Direct file
|
|
712
|
+
* deliveries mount their version resource at the declared target without the
|
|
713
|
+
* launcher. Runtime assets are mounted read-only; no shell, symlink, or
|
|
714
|
+
* aggregate material file participates in delivery.
|
|
715
|
+
*/
|
|
716
|
+
export const createWorkloadInitEnvironmentMap = async (manifestArg) => {
|
|
717
|
+
if (validateResolvedSecretManifest(manifestArg).length > 0
|
|
718
|
+
|| !await verifyResolvedSecretManifestDigest(manifestArg)) {
|
|
719
|
+
throw new Error('workload init map requires a valid digest-verified manifest');
|
|
720
|
+
}
|
|
721
|
+
const entries = await Promise.all(manifestArg.entries
|
|
722
|
+
.filter((entryArg) => entryArg.delivery.type === 'launcher-environment')
|
|
723
|
+
.map(async (entryArg) => {
|
|
724
|
+
const resource = await createDockerSecretResourceName(entryArg.secretVersionId);
|
|
725
|
+
return {
|
|
726
|
+
variableName: entryArg.delivery.variableName,
|
|
727
|
+
resource,
|
|
728
|
+
source: createLauncherSecretSourcePath(resource),
|
|
729
|
+
};
|
|
730
|
+
}));
|
|
731
|
+
entries.sort((leftArg, rightArg) => (leftArg.variableName < rightArg.variableName
|
|
732
|
+
? -1
|
|
733
|
+
: leftArg.variableName > rightArg.variableName ? 1 : 0));
|
|
734
|
+
if (new Set(entries.map((entryArg) => entryArg.variableName)).size !== entries.length
|
|
735
|
+
|| new Set(entries.map((entryArg) => entryArg.resource)).size !== entries.length
|
|
736
|
+
|| new Set(entries.map((entryArg) => entryArg.source)).size !== entries.length) {
|
|
737
|
+
throw new Error('workload init map entries must have unique variable, resource, and source fields');
|
|
738
|
+
}
|
|
739
|
+
return {
|
|
740
|
+
schemaVersion: 1,
|
|
741
|
+
manifestId: manifestArg.id,
|
|
742
|
+
manifestDigest: manifestArg.digest,
|
|
743
|
+
entries,
|
|
744
|
+
};
|
|
745
|
+
};
|
|
746
|
+
export const verifyWorkloadInitEnvironmentMap = async (mapArg, manifestArg) => {
|
|
747
|
+
if (!isRecord(mapArg)
|
|
748
|
+
|| !hasExactKeys(mapArg, ['schemaVersion', 'manifestId', 'manifestDigest', 'entries'])) {
|
|
749
|
+
return false;
|
|
750
|
+
}
|
|
751
|
+
try {
|
|
752
|
+
const expected = await createWorkloadInitEnvironmentMap(manifestArg);
|
|
753
|
+
return JSON.stringify(mapArg) === JSON.stringify(expected);
|
|
754
|
+
}
|
|
755
|
+
catch {
|
|
756
|
+
return false;
|
|
757
|
+
}
|
|
758
|
+
};
|
|
759
|
+
export const createWorkloadInitWrappedInvocation = (originalArgvArg) => {
|
|
760
|
+
if (!Array.isArray(originalArgvArg)
|
|
761
|
+
|| originalArgvArg.length === 0
|
|
762
|
+
|| originalArgvArg.some((argumentArg) => typeof argumentArg !== 'string'
|
|
763
|
+
|| argumentArg.length === 0
|
|
764
|
+
|| argumentArg.includes('\0'))) {
|
|
765
|
+
throw new Error('original argv must be a non-empty canonical argument vector');
|
|
766
|
+
}
|
|
767
|
+
return {
|
|
768
|
+
command: [workloadInitExecutablePath],
|
|
769
|
+
args: ['run', '--map', workloadInitEnvironmentMapPath, '--', ...originalArgvArg],
|
|
770
|
+
};
|
|
771
|
+
};
|
|
772
|
+
export const secretRecipientLimits = Object.freeze({
|
|
773
|
+
maximumRecipients: 64,
|
|
774
|
+
});
|
|
775
|
+
const rawX25519PublicKeyRegex = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
|
|
776
|
+
export const validateSecretRecipientMetadata = (recipientArg) => {
|
|
777
|
+
if (!isRecord(recipientArg))
|
|
778
|
+
return ['secret recipient must be an object'];
|
|
779
|
+
const lifecycleState = recipientArg.lifecycleState;
|
|
780
|
+
const requiredKeys = lifecycleState === 'active'
|
|
781
|
+
? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState']
|
|
782
|
+
: lifecycleState === 'retiring'
|
|
783
|
+
? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'acceptUntil']
|
|
784
|
+
: lifecycleState === 'revoked'
|
|
785
|
+
? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'revokedAt']
|
|
786
|
+
: [];
|
|
787
|
+
if (requiredKeys.length === 0 || !hasExactKeys(recipientArg, requiredKeys)) {
|
|
788
|
+
return ['secret recipient must use its exact lifecycle schema'];
|
|
789
|
+
}
|
|
790
|
+
const errors = [];
|
|
791
|
+
if (recipientArg.schemaVersion !== 1)
|
|
792
|
+
errors.push('secret recipient schemaVersion must be 1');
|
|
793
|
+
if (!isSecretIdentifier(recipientArg.recipientKeyId)) {
|
|
794
|
+
errors.push('secret recipient key id must be canonical');
|
|
795
|
+
}
|
|
796
|
+
if (typeof recipientArg.publicKey !== 'string'
|
|
797
|
+
|| !rawX25519PublicKeyRegex.test(recipientArg.publicKey)) {
|
|
798
|
+
errors.push('secret recipient public key must be canonical base64url raw X25519 material');
|
|
799
|
+
}
|
|
800
|
+
for (const field of ['generation', 'activatedAt']) {
|
|
801
|
+
if (!Number.isSafeInteger(recipientArg[field]) || recipientArg[field] < 1) {
|
|
802
|
+
errors.push(`secret recipient ${field} must be a positive integer`);
|
|
803
|
+
}
|
|
804
|
+
}
|
|
805
|
+
if (lifecycleState === 'retiring'
|
|
806
|
+
&& (!Number.isSafeInteger(recipientArg.acceptUntil)
|
|
807
|
+
|| recipientArg.acceptUntil <= recipientArg.activatedAt)) {
|
|
808
|
+
errors.push('retiring secret recipient acceptUntil must follow activation');
|
|
809
|
+
}
|
|
810
|
+
if (lifecycleState === 'revoked'
|
|
811
|
+
&& (!Number.isSafeInteger(recipientArg.revokedAt)
|
|
812
|
+
|| recipientArg.revokedAt < recipientArg.activatedAt)) {
|
|
813
|
+
errors.push('revoked secret recipient revokedAt must not precede activation');
|
|
814
|
+
}
|
|
815
|
+
return errors;
|
|
816
|
+
};
|
|
817
|
+
export const validateSecretRecipientSet = (recipientsArg) => {
|
|
818
|
+
if (!Array.isArray(recipientsArg)
|
|
819
|
+
|| recipientsArg.length === 0
|
|
820
|
+
|| recipientsArg.length > secretRecipientLimits.maximumRecipients) {
|
|
821
|
+
return [
|
|
822
|
+
`secret recipient set must contain between 1 and ${secretRecipientLimits.maximumRecipients} entries`,
|
|
823
|
+
];
|
|
824
|
+
}
|
|
825
|
+
const errors = recipientsArg.flatMap((recipientArg, indexArg) => (validateSecretRecipientMetadata(recipientArg)
|
|
826
|
+
.map((errorArg) => `recipients[${indexArg}].${errorArg}`)));
|
|
827
|
+
const recipients = recipientsArg.filter(isRecord);
|
|
828
|
+
if (recipients.filter((recipientArg) => recipientArg.lifecycleState === 'active').length !== 1) {
|
|
829
|
+
errors.push('secret recipient set must contain exactly one active recipient');
|
|
830
|
+
}
|
|
831
|
+
const keyIds = recipients.map((recipientArg) => recipientArg.recipientKeyId);
|
|
832
|
+
const generations = recipients.map((recipientArg) => recipientArg.generation);
|
|
833
|
+
if (new Set(keyIds).size !== keyIds.length)
|
|
834
|
+
errors.push('secret recipient key ids must be unique');
|
|
835
|
+
if (new Set(generations).size !== generations.length) {
|
|
836
|
+
errors.push('secret recipient generations must be unique');
|
|
837
|
+
}
|
|
838
|
+
const activeRecipient = recipients.find((recipientArg) => recipientArg.lifecycleState === 'active');
|
|
839
|
+
const numericGenerations = generations.filter((generationArg) => (Number.isSafeInteger(generationArg)));
|
|
840
|
+
if (activeRecipient
|
|
841
|
+
&& Number.isSafeInteger(activeRecipient.generation)
|
|
842
|
+
&& numericGenerations.length > 0
|
|
843
|
+
&& activeRecipient.generation !== Math.max(...numericGenerations)) {
|
|
844
|
+
errors.push('the active secret recipient must have the greatest generation');
|
|
845
|
+
}
|
|
846
|
+
return errors;
|
|
847
|
+
};
|
|
848
|
+
/** New envelopes target only active recipients. */
|
|
849
|
+
export const canIssueNewSecretEnvelope = (recipientArg) => recipientArg.lifecycleState === 'active';
|
|
850
|
+
export const validateSecretValueInputForRecipient = async (valueInputArg, recipientArg, expectedContextArg) => {
|
|
851
|
+
const errors = validateSecretValueInput(valueInputArg);
|
|
852
|
+
if (errors.length > 0 || !isRecord(valueInputArg) || valueInputArg.mode !== 'sealed') {
|
|
853
|
+
return errors;
|
|
854
|
+
}
|
|
855
|
+
if (!canIssueNewSecretEnvelope(recipientArg)) {
|
|
856
|
+
errors.push('new sealed inputs require the active ingress recipient');
|
|
857
|
+
}
|
|
858
|
+
try {
|
|
859
|
+
const envelope = plugins.smartcrypto.parseX25519Envelope(valueInputArg.envelope);
|
|
860
|
+
if (envelope.recipientKeyId !== recipientArg.recipientKeyId) {
|
|
861
|
+
errors.push('sealed input recipient does not match the active ingress recipient');
|
|
862
|
+
}
|
|
863
|
+
if (!await verifySecretEnvelopeContext(envelope, expectedContextArg)) {
|
|
864
|
+
errors.push('sealed input context does not match the request');
|
|
865
|
+
}
|
|
866
|
+
}
|
|
867
|
+
catch {
|
|
868
|
+
// validateSecretValueInput already reports malformed envelopes.
|
|
869
|
+
}
|
|
870
|
+
return errors;
|
|
871
|
+
};
|
|
872
|
+
/** Retiring recipients open only already-issued envelopes before their deadline. */
|
|
873
|
+
export const canOpenIssuedSecretEnvelope = (recipientArg, issuedAtArg, nowArg) => Number.isSafeInteger(issuedAtArg)
|
|
874
|
+
&& Number.isSafeInteger(nowArg)
|
|
875
|
+
&& issuedAtArg >= recipientArg.activatedAt
|
|
876
|
+
&& issuedAtArg <= nowArg
|
|
877
|
+
&& (recipientArg.lifecycleState === 'active'
|
|
878
|
+
|| (recipientArg.lifecycleState === 'retiring'
|
|
879
|
+
&& issuedAtArg < recipientArg.acceptUntil
|
|
880
|
+
&& nowArg < recipientArg.acceptUntil));
|
|
881
|
+
const canonicalSecretOwner = (ownerArg) => {
|
|
882
|
+
switch (ownerArg.kind) {
|
|
883
|
+
case 'service': return { kind: ownerArg.kind, serviceId: ownerArg.serviceId };
|
|
884
|
+
case 'secret-set': return { kind: ownerArg.kind, secretSetId: ownerArg.secretSetId };
|
|
885
|
+
case 'platform-provider': return {
|
|
886
|
+
kind: ownerArg.kind,
|
|
887
|
+
providerConfigId: ownerArg.providerConfigId,
|
|
888
|
+
};
|
|
889
|
+
case 'system': return { kind: ownerArg.kind, systemId: ownerArg.systemId };
|
|
890
|
+
}
|
|
891
|
+
};
|
|
892
|
+
const canonicalSecretDelivery = (deliveryArg) => (deliveryArg.type === 'launcher-environment'
|
|
893
|
+
? {
|
|
894
|
+
type: deliveryArg.type,
|
|
895
|
+
variableName: deliveryArg.variableName,
|
|
896
|
+
uid: deliveryArg.uid,
|
|
897
|
+
gid: deliveryArg.gid,
|
|
898
|
+
mode: deliveryArg.mode,
|
|
899
|
+
}
|
|
900
|
+
: {
|
|
901
|
+
type: deliveryArg.type,
|
|
902
|
+
targetPath: deliveryArg.targetPath,
|
|
903
|
+
uid: deliveryArg.uid,
|
|
904
|
+
gid: deliveryArg.gid,
|
|
905
|
+
mode: deliveryArg.mode,
|
|
906
|
+
});
|
|
907
|
+
const contextBytes = (valueArg) => (new TextEncoder().encode(JSON.stringify(valueArg)));
|
|
908
|
+
export const createSecretCreateEnvelopeContext = (contextArg) => contextBytes({
|
|
909
|
+
schemaVersion: 1,
|
|
910
|
+
purpose: 'serve.zone/secret-create',
|
|
911
|
+
mutationId: contextArg.mutationId,
|
|
912
|
+
target: canonicalSecretOwner(contextArg.target),
|
|
913
|
+
key: contextArg.key,
|
|
914
|
+
environment: contextArg.environment,
|
|
915
|
+
delivery: canonicalSecretDelivery(contextArg.delivery),
|
|
916
|
+
expectedTargetSecretsRevision: contextArg.expectedTargetSecretsRevision,
|
|
917
|
+
});
|
|
918
|
+
export const createSecretRotateEnvelopeContext = (contextArg) => contextBytes({
|
|
919
|
+
schemaVersion: 1,
|
|
920
|
+
purpose: 'serve.zone/secret-rotate',
|
|
921
|
+
mutationId: contextArg.mutationId,
|
|
922
|
+
secretId: contextArg.secretId,
|
|
923
|
+
expectedSecretRevision: contextArg.expectedSecretRevision,
|
|
924
|
+
expectedActiveVersionId: contextArg.expectedActiveVersionId,
|
|
925
|
+
expectedTargetSecretsRevision: contextArg.expectedTargetSecretsRevision,
|
|
926
|
+
});
|
|
927
|
+
export const createAppStoreInstallSecretEnvelopeContext = (contextArg) => contextBytes({
|
|
928
|
+
schemaVersion: 1,
|
|
929
|
+
purpose: 'serve.zone/app-install-secret',
|
|
930
|
+
mutationId: contextArg.mutationId,
|
|
931
|
+
appId: contextArg.appId,
|
|
932
|
+
appVersion: contextArg.appVersion,
|
|
933
|
+
serviceId: contextArg.serviceId,
|
|
934
|
+
key: contextArg.key,
|
|
935
|
+
delivery: canonicalSecretDelivery(contextArg.delivery),
|
|
936
|
+
generation: contextArg.generation
|
|
937
|
+
? { encoding: contextArg.generation.encoding, bytes: contextArg.generation.bytes }
|
|
938
|
+
: null,
|
|
939
|
+
});
|
|
940
|
+
export const createResolvedSecretMaterialEnvelopeContext = (contextArg) => contextBytes({
|
|
941
|
+
schemaVersion: 1,
|
|
942
|
+
purpose: 'serve.zone/resolved-secret-material',
|
|
943
|
+
recipientKeyId: contextArg.recipientKeyId,
|
|
944
|
+
organizationId: contextArg.organizationId,
|
|
945
|
+
clusterId: contextArg.clusterId,
|
|
946
|
+
serviceId: contextArg.serviceId,
|
|
947
|
+
imageRolloutId: contextArg.imageRolloutId,
|
|
948
|
+
imageRolloutGeneration: contextArg.imageRolloutGeneration,
|
|
949
|
+
requestedImageDigest: contextArg.requestedImageDigest,
|
|
950
|
+
secretRolloutId: contextArg.secretRolloutId,
|
|
951
|
+
secretRolloutGeneration: contextArg.secretRolloutGeneration,
|
|
952
|
+
manifestId: contextArg.manifestId,
|
|
953
|
+
manifestDigest: contextArg.manifestDigest,
|
|
954
|
+
secretId: contextArg.secretId,
|
|
955
|
+
secretVersionId: contextArg.secretVersionId,
|
|
956
|
+
});
|
|
957
|
+
export const createSecretRecipientEnrollmentChallengeContext = (contextArg) => contextBytes({
|
|
958
|
+
schemaVersion: 1,
|
|
959
|
+
purpose: 'serve.zone/secret-recipient-enrollment-challenge',
|
|
960
|
+
enrollmentId: contextArg.enrollmentId,
|
|
961
|
+
clusterId: contextArg.clusterId,
|
|
962
|
+
recipientKeyId: contextArg.recipientKeyId,
|
|
963
|
+
publicKey: contextArg.publicKey,
|
|
964
|
+
generation: contextArg.generation,
|
|
965
|
+
expiresAt: contextArg.expiresAt,
|
|
966
|
+
});
|
|
967
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9zZWNyZXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFFekMsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBZ0I1RCxnRkFBZ0Y7QUFDaEYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsaUJBQStDLEVBQy9DLCtCQUF3QyxFQUMvQixFQUFFLENBQUMsaUJBQWlCLEtBQUssUUFBUTtPQUN2QyxDQUFDLGlCQUFpQixLQUFLLFNBQVMsSUFBSSwrQkFBK0IsQ0FBQyxDQUFDO0FBaUsxRSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzdDLFlBQVksRUFBRSxHQUFHLEdBQUcsSUFBSTtJQUN4QixxQkFBcUIsRUFBRSxFQUFFO0lBQ3pCLHFCQUFxQixFQUFFLEVBQUU7Q0FDMUIsQ0FBQyxDQUFDO0FBaUhILE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQ25ELE9BQXFELEVBQ3JELFFBQXNELEVBQzdDLEVBQUUsQ0FBQyxDQUNaLE9BQU8sQ0FBQyxPQUFPLENBQUM7T0FDYixPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2pCLE9BQU8sRUFBRSxVQUFVLEtBQUssUUFBUSxFQUFFLFVBQVU7T0FDNUMsT0FBTyxFQUFFLGNBQWMsS0FBSyxRQUFRLEVBQUUsY0FBYztPQUNwRCxPQUFPLEVBQUUsU0FBUyxLQUFLLFFBQVEsRUFBRSxTQUFTO09BQzFDLE9BQU8sRUFBRSxjQUFjLEtBQUssUUFBUSxFQUFFLGNBQWM7T0FDcEQsT0FBTyxFQUFFLHNCQUFzQixLQUFLLFFBQVEsRUFBRSxzQkFBc0I7T0FDcEUsT0FBTyxFQUFFLG9CQUFvQixLQUFLLFFBQVEsRUFBRSxvQkFBb0I7T0FDaEUsT0FBTyxFQUFFLGdCQUFnQixLQUFLLFFBQVEsRUFBRSxnQkFBZ0I7T0FDeEQsT0FBTyxFQUFFLGVBQWUsS0FBSyxRQUFRLEVBQUUsZUFBZTtPQUN0RCxPQUFPLEVBQUUsdUJBQXVCLEtBQUssUUFBUSxFQUFFLHVCQUF1QixDQUMxRSxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FDdkQsUUFBdUMsRUFDdkMsWUFBOEMsRUFDOUMsTUFBYyxFQUNMLEVBQUUsQ0FBQyxDQUNaLHFDQUFxQyxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsWUFBWSxDQUFDO09BQzFFLHFDQUFxQyxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsWUFBWSxDQUFDO09BQzdFLENBQ0QsT0FBTyxDQUFDLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztXQUN2QyxNQUFNLEdBQUcsUUFBUSxDQUFDLHdCQUF5QixDQUFDLGFBQWE7V0FDekQscUNBQXFDLENBQ3RDLFFBQVEsQ0FBQyx3QkFBeUIsQ0FBQyxRQUFRLEVBQzNDLFlBQVksQ0FDYixDQUNGLENBQ0YsQ0FBQztBQUVGLE1BQU0scUJBQXFCLEdBQUcscUNBQXFDLENBQUM7QUFDcEUsTUFBTSxzQkFBc0IsR0FBRyxtQ0FBbUMsQ0FBQztBQUNuRSxNQUFNLGNBQWMsR0FBRywwQkFBMEIsQ0FBQztBQUNsRCxNQUFNLGlCQUFpQixHQUFHLHVCQUF1QixDQUFDO0FBQ2xELE1BQU0sMEJBQTBCLEdBQzlCLGlGQUFpRixDQUFDO0FBRXBGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUM5RSxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FDbkIsUUFBaUMsRUFDakMsT0FBaUIsRUFDUixFQUFFO0lBQ1gsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM1QyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckMsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0QsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FDbEIsUUFBaUMsRUFDakMsT0FBaUIsRUFDUixFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUVoRixNQUFNLGtCQUFrQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3BFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3JFLENBQUM7QUFFRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM3RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDOUQsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDckUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDdEUsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsYUFBc0IsRUFBWSxFQUFFLENBQUMsQ0FDNUUsa0JBQWtCLENBQUMsYUFBYSxDQUFDO0lBQy9CLENBQUMsQ0FBQyxFQUFFO0lBQ0osQ0FBQyxDQUFDLENBQUMsMkNBQTJDLENBQUMsQ0FDbEQsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBWSxFQUFFO0lBQ2pFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDbkUsTUFBTSxXQUFXLEdBQUc7UUFDbEIsT0FBTyxFQUFFLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQztRQUM5QixZQUFZLEVBQUUsQ0FBQyxNQUFNLEVBQUUsYUFBYSxDQUFDO1FBQ3JDLG1CQUFtQixFQUFFLENBQUMsTUFBTSxFQUFFLGtCQUFrQixDQUFDO1FBQ2pELE1BQU0sRUFBRSxDQUFDLE1BQU0sRUFBRSxVQUFVLENBQUM7S0FDcEIsQ0FBQztJQUNYLE1BQU0sSUFBSSxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBZ0MsQ0FBQyxDQUFDO0lBQ3BFLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEQsT0FBTyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN4QixPQUFPLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUMxQyxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixPQUFPLG9CQUFvQixDQUFDLENBQUM7QUFDcEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FDM0MsU0FBa0MsRUFDbEMsUUFBaUIsRUFDUCxFQUFFO0lBQ1osSUFBSSxRQUFRLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDNUIsT0FBTyxTQUFTLEtBQUssVUFBVTtZQUM3QixDQUFDLENBQUMsRUFBRTtZQUNKLENBQUMsQ0FBQyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsMEJBQTBCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLFNBQVMsR0FBRyxDQUFDO1FBQ3pDLENBQUMsQ0FBQyxFQUFFO1FBQ0osQ0FBQyxDQUFDLENBQUMsc0RBQXNELENBQUMsQ0FBQztBQUMvRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFdBQW9CLEVBQVksRUFBRTtJQUN2RSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztRQUFFLE9BQU8sQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxJQUFJLEtBQUssc0JBQXNCLENBQUM7SUFDL0QsSUFBSSxDQUFDLFVBQVUsSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQy9DLE9BQU8sQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxVQUFVO1FBQzdCLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxjQUFjLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUM7UUFDaEQsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2pELElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDN0MsT0FBTyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFVBQVUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxPQUFPLFdBQVcsQ0FBQyxVQUFVLEtBQUssUUFBUTtXQUN6RCw0QkFBNEIsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssV0FBVyxDQUFDLFVBQVU7V0FDL0UsQ0FBQyxvREFBb0QsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN6RixNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFVLEVBQUUsQ0FBQztRQUM1QyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO2VBQzFCLEtBQWdCLEdBQUcsQ0FBQztlQUNwQixLQUFnQixHQUFHLGFBQWEsRUFBRSxDQUFDO1lBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTSxhQUFhLEtBQUsscUNBQXFDLENBQUMsQ0FBQztRQUMxRyxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUM3RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsVUFBVSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0scUNBQXFDLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxhQUFzQixFQUFZLEVBQUU7SUFDM0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUM7UUFBRSxPQUFPLENBQUMsOEJBQThCLENBQUMsQ0FBQztJQUN0RSxJQUFJLGFBQWEsQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLFlBQVksQ0FBQyxhQUFhLEVBQUUsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE9BQU8sQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNqRixPQUFPLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTTttQkFDNUIsSUFBSSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxZQUFZLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDcEQsQ0FBQyxDQUFDLEVBQUU7Z0JBQ0osQ0FBQyxDQUFDLENBQUMsMENBQTBDLGlCQUFpQixDQUFDLFlBQVksUUFBUSxDQUFDLENBQUM7UUFDekYsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8sQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxhQUFhLENBQUMsSUFBSSxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxZQUFZLENBQUMsYUFBYSxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDaEUsT0FBTyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztRQUM1QixJQUFJLGFBQWEsQ0FBQyxRQUFRLEtBQUssS0FBSyxJQUFJLGFBQWEsQ0FBQyxRQUFRLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDL0UsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO2VBQ3hDLGFBQWEsQ0FBQyxLQUFnQixHQUFHLGlCQUFpQixDQUFDLHFCQUFxQjtlQUN4RSxhQUFhLENBQUMsS0FBZ0IsR0FBRyxpQkFBaUIsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1lBQy9FLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE9BQU8sQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0FBQ3pELENBQUMsQ0FBQztBQUVGLE1BQU0sZUFBZSxHQUFHLENBQUMsUUFBb0IsRUFBVSxFQUFFO0lBQ3ZELElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLFFBQVE7UUFBRSxNQUFNLElBQUksTUFBTSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRSxPQUFPLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1NBQzNCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDO1NBQ25CLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDO1NBQ25CLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDeEIsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLEtBQUssRUFDOUMsV0FBb0IsRUFDcEIsVUFBbUIsRUFDRCxFQUFFO0lBQ3BCLElBQUksQ0FBQyxDQUFDLFVBQVUsWUFBWSxVQUFVLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN0RCxJQUFJLFFBQStDLENBQUM7SUFDcEQsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUN4RSxTQUFTLEVBQ1QsSUFBSSxVQUFVLENBQUMsVUFBVSxDQUFDLENBQzNCLENBQUMsQ0FBQztJQUNILE9BQU8sUUFBUSxDQUFDLGFBQWEsS0FBSyxlQUFlLENBQUMsYUFBYSxDQUFDLENBQUM7QUFDbkUsQ0FBQyxDQUFDO0FBRUYscUZBQXFGO0FBQ3JGLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQ3RDLGFBQXNCLEVBQ3RCLFdBQTRCLEVBQ2xCLEVBQUU7SUFDWixJQUFJLENBQUMsQ0FBQyxhQUFhLFlBQVksVUFBVSxDQUFDO1FBQUUsT0FBTyxDQUFDLCtCQUErQixDQUFDLENBQUM7SUFDckYsSUFBSSxhQUFhLENBQUMsVUFBVSxHQUFHLGlCQUFpQixDQUFDLFlBQVksRUFBRSxDQUFDO1FBQzlELE9BQU8sQ0FBQyxtQ0FBbUMsaUJBQWlCLENBQUMsWUFBWSxRQUFRLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLE1BQU07UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUMzQyxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDaEYsT0FBTyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztZQUMzQixDQUFDLENBQUMsQ0FBQywrQ0FBK0MsQ0FBQztZQUNuRCxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1QsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzFELENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxXQUlyQyxFQUFtQixFQUFFLENBQUMsQ0FDckIsV0FBVyxDQUFDLGdCQUFnQjtPQUN6QixXQUFXLENBQUMsa0JBQWtCO09BQzlCLFdBQVcsQ0FBQyxhQUFhLENBQzdCLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxnQkFBeUIsRUFDZixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLGdCQUFnQixFQUFFO1FBQ2xDLGVBQWU7UUFDZixVQUFVO1FBQ1YsaUJBQWlCO1FBQ2pCLHNCQUFzQjtLQUN2QixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekMsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7UUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQ3JELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxJQUFJLGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUN0RCxNQUFNLENBQUMsSUFBSSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7UUFDcEUsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQztXQUM5QyxnQkFBZ0IsQ0FBQyxRQUFtQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQy9DLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDO1dBQ3JELGdCQUFnQixDQUFDLGVBQTBCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxNQUFNLGFBQWEsR0FBYSxFQUFFLENBQUM7SUFDbkMsTUFBTSxrQkFBa0IsR0FBYSxFQUFFLENBQUM7SUFDeEMsS0FBSyxNQUFNLENBQUMsZUFBZSxFQUFFLFNBQVMsQ0FBQyxJQUFJLGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDM0YsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUscUJBQXFCLENBQUMsQ0FBQztZQUMxRSxTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQUUsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUsK0JBQStCLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQ0QsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUscUNBQXFDLENBQUMsQ0FBQztRQUM1RixDQUFDO2FBQU0sQ0FBQztZQUNOLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ25DLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDL0MsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSw4Q0FBOEMsQ0FDdEYsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDaEQsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSwrQ0FBK0MsQ0FDdkYsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUM7ZUFDeEMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDaEQsa0JBQWtCLENBQUMsSUFBSSxDQUFDLEdBQUcsU0FBUyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsSUFBSSxTQUFTLENBQUMsUUFBUSxLQUFLLFNBQVM7WUFBRSxTQUFTO1FBQy9DLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxTQUFTLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztZQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLG9DQUFvQyxDQUFDLENBQUM7WUFDekYsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7UUFDaEMsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBQ2hDLEtBQUssTUFBTSxDQUFDLFlBQVksRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUM1RSxJQUFJLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztnQkFDaEMsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSxjQUFjLFlBQVkscUJBQXFCLENBQ3ZGLENBQUM7Z0JBQ0YsU0FBUztZQUNYLENBQUM7WUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLGdCQUFnQixFQUFFLENBQUMsV0FBVyxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsd0JBQXdCLGVBQWUsY0FBYyxZQUFZLCtCQUErQixDQUNqRyxDQUFDO1lBQ0osQ0FBQztZQUNELElBQUksQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSxjQUFjLFlBQVksK0JBQStCLENBQ2pHLENBQUM7WUFDSixDQUFDO2lCQUFNLENBQUM7Z0JBQ04sVUFBVSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQ0QsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsU0FBUyxJQUFJLGdCQUFnQixDQUFDLFNBQVMsQ0FBQztZQUMxRSxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsd0JBQXdCLGVBQWUsY0FBYyxZQUFZLCtCQUErQixDQUNqRyxDQUFDO1lBQ0osQ0FBQztpQkFBTSxDQUFDO2dCQUNOLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDNUIsQ0FBQztZQUNELElBQUksZ0JBQWdCLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsc0JBQXNCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLENBQUMsR0FBRyxDQUNsRSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDWix3QkFBd0IsZUFBZSxjQUFjLFlBQVksS0FBSyxRQUFRLEVBQUUsQ0FDakYsQ0FDRixDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLElBQUksS0FBSyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUMsSUFBSSxLQUFLLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsZ0JBQTZDLEVBQzdDLHdCQUFnQyxFQUNoQyxhQUFtQyxFQUN6QixFQUFFO0lBQ1osTUFBTSxNQUFNLEdBQUcsa0NBQWtDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUNwRSxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQztRQUNqRSxZQUFZLENBQUMsRUFBRTtRQUNmLFlBQVk7S0FDYixDQUFDLENBQUMsQ0FBQztJQUNKLEtBQUssTUFBTSxVQUFVLElBQUksZ0JBQWdCLENBQUMsb0JBQW9CLElBQUksRUFBRSxFQUFFLENBQUM7UUFDckUsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGlCQUFpQixDQUFDLENBQUM7UUFDcEUsQ0FBQzthQUFNLElBQUksU0FBUyxDQUFDLGNBQWMsS0FBSyx3QkFBd0IsRUFBRSxDQUFDO1lBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxVQUFVLENBQUMsV0FBVyxrQ0FBa0MsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7YUFBTSxJQUFJLFNBQVMsQ0FBQyxjQUFjLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGdCQUFnQixDQUFDLENBQUM7UUFDbkUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxXQUFvQyxFQUM1QixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixhQUFhLEVBQUUsV0FBVyxDQUFDLGFBQWE7SUFDeEMsRUFBRSxFQUFFLFdBQVcsQ0FBQyxFQUFFO0lBQ2xCLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztJQUMxQyxTQUFTLEVBQUUsV0FBVyxDQUFDLFNBQVM7SUFDaEMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO0lBQ2hDLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztJQUMxQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsc0JBQXNCO0lBQzFELG9CQUFvQixFQUFFLFdBQVcsQ0FBQyxvQkFBb0I7SUFDdEQsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLGdCQUFnQjtJQUM5QyxlQUFlLEVBQUUsV0FBVyxDQUFDLGVBQWU7SUFDNUMsdUJBQXVCLEVBQUUsV0FBVyxDQUFDLHVCQUF1QjtJQUM1RCxPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDOUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO1FBQzNCLGVBQWUsRUFBRSxRQUFRLENBQUMsZUFBZTtRQUN6QyxHQUFHLEVBQUUsUUFBUSxDQUFDLEdBQUc7UUFDakIsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXO1FBQ2pDLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO1lBQ3RDLENBQUMsQ0FBQztnQkFDRSxJQUFJLEVBQUUsU0FBUztnQkFDZixTQUFTLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTO2FBQ3BDO1lBQ0gsQ0FBQyxDQUFDO2dCQUNFLElBQUksRUFBRSxZQUFZO2dCQUNsQixXQUFXLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxXQUFXO2FBQ3hDO1FBQ0wsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLHNCQUFzQjtZQUN6RCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLHNCQUFzQjtnQkFDNUIsWUFBWSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsWUFBWTtnQkFDNUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsSUFBSSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSTthQUM3QjtZQUNILENBQUMsQ0FBQztnQkFDRSxJQUFJLEVBQUUsTUFBTTtnQkFDWixVQUFVLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxVQUFVO2dCQUN4QyxHQUFHLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHO2dCQUMxQixHQUFHLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHO2dCQUMxQixJQUFJLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJO2FBQzdCO0tBQ04sQ0FBQyxDQUFDO0lBQ0gsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO0NBQ2pDLENBQUMsQ0FBQztBQUVILG1GQUFtRjtBQUNuRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxLQUFLLEVBQ3RELFdBQW9DLEVBQ1osRUFBRTtJQUMxQixNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyx1Q0FBdUMsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQy9GLE1BQU0sWUFBWSxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUMvRSxNQUFNLFNBQVMsR0FBRyxDQUFDLEdBQUcsSUFBSSxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUM7U0FDaEQsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7U0FDdkQsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ1osT0FBTyxVQUFVLFNBQVMsRUFBbUIsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxLQUFLLEVBQ3JELFdBQW9DLEVBQ2xCLEVBQUUsQ0FBQyxDQUNyQixXQUFXLENBQUMsTUFBTSxLQUFLLE1BQU0sbUNBQW1DLENBQUMsV0FBVyxDQUFDLENBQzlFLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxXQUFvQixFQUNWLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztRQUFFLE9BQU8sQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0lBQ3pFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRTtRQUM3QixlQUFlO1FBQ2YsSUFBSTtRQUNKLFFBQVE7UUFDUixnQkFBZ0I7UUFDaEIsV0FBVztRQUNYLFdBQVc7UUFDWCxnQkFBZ0I7UUFDaEIsd0JBQXdCO1FBQ3hCLHNCQUFzQjtRQUN0QixrQkFBa0I7UUFDbEIsaUJBQWlCO1FBQ2pCLHlCQUF5QjtRQUN6QixTQUFTO1FBQ1QsV0FBVztLQUNaLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxJQUFJLFdBQVcsQ0FBQyxhQUFhLEtBQUssQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUM1RixLQUFLLE1BQU0sS0FBSyxJQUFJO1FBQ2xCLElBQUk7UUFDSixnQkFBZ0I7UUFDaEIsV0FBVztRQUNYLFdBQVc7UUFDWCxnQkFBZ0I7UUFDaEIsaUJBQWlCO0tBQ1QsRUFBRSxDQUFDO1FBQ1gsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsS0FBSyxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLHNCQUFzQixFQUFFLGtCQUFrQixDQUFVLEVBQUUsQ0FBQztRQUMxRSxJQUFJLE9BQU8sV0FBVyxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEtBQUssb0NBQW9DLENBQUMsQ0FBQztRQUM1RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxzQkFBc0IsQ0FBQztXQUN2RCxXQUFXLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxXQUFXLENBQUMsdUJBQXVCLENBQUM7V0FDeEQsV0FBVyxDQUFDLHVCQUFrQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pELE1BQU0sQ0FBQyxJQUFJLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxJQUFLLFdBQVcsQ0FBQyxTQUFvQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFdBQVcsQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztRQUMvRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQWEsRUFBRSxDQUFDO0lBQy9CLE1BQU0sU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUMvQixNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7SUFDaEMsTUFBTSwwQkFBMEIsR0FBYSxFQUFFLENBQUM7SUFDaEQsTUFBTSxtQkFBbUIsR0FBYSxFQUFFLENBQUM7SUFDekMsSUFBSSxlQUFtQyxDQUFDO0lBQ3hDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxTQUFTLENBQUMsSUFBSSxXQUFXLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDL0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLEtBQUsscUJBQXFCLENBQUMsQ0FBQztZQUNuRSxTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFO1lBQzNCLFVBQVU7WUFDVixpQkFBaUI7WUFDakIsS0FBSztZQUNMLGFBQWE7WUFDYixPQUFPO1lBQ1AsVUFBVTtTQUNYLENBQUMsRUFBRSxDQUFDO1lBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsS0FBSyw2QkFBNkIsQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQzlFLENBQUM7YUFBTSxDQUFDO1lBQ04sU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDckMsQ0FBQztRQUNELElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHFDQUFxQyxDQUFDLENBQUM7UUFDckYsQ0FBQzthQUFNLENBQUM7WUFDTixVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHlCQUF5QixDQUFDLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLGlDQUFpQyxDQUFDLENBQUM7UUFDakYsQ0FBQzthQUFNLElBQUksV0FBVyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUM7ZUFDekIsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZLENBQ3pDO2VBQ0UsQ0FBQyxZQUFZLENBQ2QsU0FBUyxDQUFDLEtBQUssRUFDZixTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO2dCQUNoQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDO2dCQUN2QixDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsYUFBYSxDQUFDLENBQzVCO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQ2xEO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZO21CQUNsQyxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQ3RELEVBQUUsQ0FBQztZQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLEtBQUssMkJBQTJCLENBQUMsQ0FBQztRQUMzRSxDQUFDO2FBQU0sSUFDTCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO2VBQy9CLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7ZUFDekMsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVMsRUFDdEQsQ0FBQztZQUNELE1BQU0sQ0FBQyxJQUFJLENBQ1QsMkJBQTJCLEtBQUsscURBQXFELENBQ3RGLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxHQUFHLENBQzNELENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQywyQkFBMkIsS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUM5RCxDQUFDLENBQUM7UUFDSCxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqQyxJQUNFLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLHNCQUFzQjttQkFDL0MsV0FBVyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQy9DLENBQUM7Z0JBQ0QsMEJBQTBCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDbkUsQ0FBQztpQkFBTSxJQUNMLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLE1BQU07bUJBQy9CLE9BQU8sU0FBUyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEtBQUssUUFBUTttQkFDakQsc0JBQXNCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQzFELENBQUM7Z0JBQ0QsbUJBQW1CLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDMUQsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLElBQUksbUJBQW1CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDN0UsTUFBTSxPQUFPLEdBQUcsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUM3RCxJQUFJLGVBQWUsS0FBSyxTQUFTLElBQUksT0FBTyxJQUFJLGVBQWUsRUFBRSxDQUFDO2dCQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7WUFDeEYsQ0FBQztZQUNELGVBQWUsR0FBRyxPQUFPLENBQUM7UUFDNUIsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLDBCQUEwQixDQUFDLENBQUMsSUFBSSxLQUFLLDBCQUEwQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25GLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLElBQUksS0FBSyxtQkFBbUIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sdUNBQXVDLEdBQUcsQ0FDOUMsWUFBcUIsRUFDckIsb0JBQTRCLEVBQzVCLE9BQWUsRUFDTCxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7V0FDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFO1lBQzdCLFlBQVk7WUFDWixnQkFBZ0I7WUFDaEIsV0FBVztZQUNYLGdCQUFnQjtZQUNoQix3QkFBd0I7WUFDeEIsc0JBQXNCO1lBQ3RCLGtCQUFrQjtZQUNsQixpQkFBaUI7WUFDakIseUJBQXlCO1NBQzFCLENBQUM7V0FDQyxDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUM7V0FDNUMsT0FBTyxZQUFZLENBQUMsY0FBYyxLQUFLLFFBQVE7V0FDL0MsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLGNBQWMsQ0FBQztXQUNwRCxZQUFZLENBQUMsU0FBUyxLQUFLLG9CQUFvQjtXQUMvQyxDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQyxjQUFjLENBQUM7V0FDaEQsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQyxzQkFBc0IsQ0FBQztXQUN6RCxZQUFZLENBQUMsc0JBQWlDLEdBQUcsQ0FBQztXQUNuRCxPQUFPLFlBQVksQ0FBQyxvQkFBb0IsS0FBSyxRQUFRO1dBQ3JELENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxvQkFBb0IsQ0FBQztXQUMxRCxPQUFPLFlBQVksQ0FBQyxnQkFBZ0IsS0FBSyxRQUFRO1dBQ2pELENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxnQkFBZ0IsQ0FBQztXQUN0RCxDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUM7V0FDakQsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQyx1QkFBdUIsQ0FBQztXQUMxRCxZQUFZLENBQUMsdUJBQWtDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUQsT0FBTyxDQUFDLEdBQUcsT0FBTywwQ0FBMEMsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLENBQ2pELE9BQWdCLEVBQ2hCLDJCQUFzQyxFQUM1QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7UUFBRSxPQUFPLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUM1RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxPQUFPLEVBQUU7UUFDekIsZUFBZTtRQUNmLFVBQVU7UUFDVixlQUFlO1FBQ2YsV0FBVztLQUNaLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxhQUFhLEtBQUssQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUMvRixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUssT0FBTyxDQUFDLFFBQW1CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUssT0FBTyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1dBQ3BDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbEMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1FBQ3RGLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7SUFDaEMsTUFBTSxzQkFBc0IsR0FBRyxJQUFJLEdBQUcsRUFBNEMsQ0FBQztJQUNuRixNQUFNLGlDQUFpQyxHQUFHLENBQ3hDLFlBQXFCLEVBQ3JCLG9CQUE0QixFQUM1QixPQUFlLEVBQ1QsRUFBRTtRQUNSLE1BQU0sZUFBZSxHQUFHLHVDQUF1QyxDQUM3RCxZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLE9BQU8sQ0FDUixDQUFDO1FBQ0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUsQ0FBQyxDQUFDO1FBQ2hDLElBQUksZUFBZSxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQUUsT0FBTztRQUN2QyxNQUFNLFNBQVMsR0FBRyxZQUFnRCxDQUFDO1FBQ25FLE1BQU0saUJBQWlCLEdBQUcsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMzRSxJQUNFLGlCQUFpQjtlQUNkLENBQUMscUNBQXFDLENBQUMsaUJBQWlCLEVBQUUsU0FBUyxDQUFDLEVBQ3ZFLENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUNULEdBQUcsT0FBTyxnRkFBZ0YsQ0FDM0YsQ0FBQztZQUNGLE9BQU87UUFDVCxDQUFDO1FBQ0Qsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksR0FBRyx3Q0FBd0MsS0FBSyxHQUFHLENBQUM7UUFDOUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhCQUE4QixDQUFDLENBQUM7WUFDbkQsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsaUJBQWlCO1lBQ2pCLGlCQUFpQjtZQUNqQiwwQkFBMEI7WUFDMUIsUUFBUTtZQUNSLFdBQVc7U0FDWixDQUFDLEVBQUUsQ0FBQztZQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhCQUE4QixDQUFDLENBQUM7UUFDckQsQ0FBQztRQUNELFVBQVUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3JDLGlDQUFpQyxDQUMvQixTQUFTLENBQUMsZUFBZSxFQUN6QixTQUFTLENBQUMsU0FBUyxFQUNuQixHQUFHLElBQUksa0JBQWtCLENBQzFCLENBQUM7UUFDRixJQUFJLFNBQVMsQ0FBQyxlQUFlLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDNUMsaUNBQWlDLENBQy9CLFNBQVMsQ0FBQyxlQUFlLEVBQ3pCLFNBQVMsQ0FBQyxTQUFTLEVBQ25CLEdBQUcsSUFBSSxrQkFBa0IsQ0FDMUIsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyx3QkFBd0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNyRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQzttQkFDNUMsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLHdCQUF3QixFQUFFLENBQUMsVUFBVSxFQUFFLGVBQWUsQ0FBQyxDQUFDO21CQUNoRixDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLHdCQUF3QixDQUFDLGFBQWEsQ0FBQzttQkFDdEUsU0FBUyxDQUFDLHdCQUF3QixDQUFDLGFBQXdCLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhEQUE4RCxDQUFDLENBQUM7WUFDckYsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGlDQUFpQyxDQUMvQixTQUFTLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUMzQyxTQUFTLENBQUMsU0FBUyxFQUNuQixHQUFHLElBQUksb0NBQW9DLENBQzVDLENBQUM7Z0JBQ0YsSUFDRSxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7dUJBQ3JDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQyxhQUF3QjswQkFDMUQsU0FBUyxDQUFDLFNBQW9CLEVBQ25DLENBQUM7b0JBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksNERBQTRELENBQUMsQ0FBQztnQkFDbkYsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsU0FBUztZQUNULFVBQVU7WUFDVixTQUFTO1lBQ1QsU0FBUztZQUNULFFBQVE7U0FDVCxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBZ0IsQ0FBQyxFQUFFLENBQUM7WUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksMkJBQTJCLENBQUMsQ0FBQztRQUNsRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxJQUFLLFNBQVMsQ0FBQyxTQUFvQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDJDQUEyQyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQ0UsU0FBUyxDQUFDLE1BQU0sS0FBSyxTQUFTO2VBQzNCLENBQUMscUNBQXFDLENBQ3ZDLFNBQVMsQ0FBQyxlQUE4RCxFQUN4RSxTQUFTLENBQUMsZUFBOEQsQ0FDekUsRUFDRCxDQUFDO1lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksNkRBQTZELENBQUMsQ0FBQztRQUNwRixDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELElBQUksMkJBQTJCLEVBQUUsQ0FBQztRQUNoQyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsMkJBQTJCLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2xFLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsVUFBVSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDeEUsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQy9GLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsc0NBQStDLENBQUM7QUFDOUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsMENBQW1ELENBQUM7QUFDbEcsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsZ0NBQXlDLENBQUM7QUFDbEYsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQ3JDLDZEQUFzRSxDQUFDO0FBQ3pFLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQWMsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxJQUFhLENBQUM7QUFFM0QsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQW9CLEVBQVUsRUFBRTtJQUM3RCxNQUFNLFFBQVEsR0FBRyxrQ0FBa0MsQ0FBQztJQUNwRCxJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7SUFDaEIsSUFBSSxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBQ3BCLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztJQUNqQixLQUFLLE1BQU0sSUFBSSxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQzVCLFdBQVcsR0FBRyxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDeEMsUUFBUSxJQUFJLENBQUMsQ0FBQztRQUNkLE9BQU8sUUFBUSxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3JCLFFBQVEsSUFBSSxDQUFDLENBQUM7WUFDZCxNQUFNLElBQUksUUFBUSxDQUFDLENBQUMsV0FBVyxLQUFLLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELENBQUM7UUFDRCxXQUFXLElBQUksQ0FBQyxDQUFDLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3JDLENBQUM7SUFDRCxJQUFJLFFBQVEsR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLFFBQVEsQ0FBQyxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsR0FBRyxRQUFRLENBQUMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzNFLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLGdGQUFnRjtBQUNoRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxLQUFLLEVBQ2pELGtCQUEwQixFQUNDLEVBQUU7SUFDN0IsSUFBSSxDQUFDLGtCQUFrQixDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUNqRSxTQUFTLEVBQ1QsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyw4QkFBOEIsS0FBSyxrQkFBa0IsRUFBRSxDQUFDLENBQ3JGLENBQUMsQ0FBQztJQUNILE1BQU0sT0FBTyxHQUFHLHFCQUFxQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzlDLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxFQUFFO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO0lBQy9FLE9BQU8sUUFBUSxPQUFPLEVBQUUsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxXQUFtQixFQUNrQixFQUFFO0lBQ3ZDLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUksS0FBSyxDQUFDLDhEQUE4RCxDQUFDLENBQUM7SUFDbEYsQ0FBQztJQUNELE9BQU8sMkJBQTJCLFdBQVcsRUFBRSxDQUFDO0FBQ2xELENBQUMsQ0FBQztBQWVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUNuRCxXQUFvQyxFQUNJLEVBQUU7SUFDMUMsSUFBSSw4QkFBOEIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNyRCxDQUFDLE1BQU0sa0NBQWtDLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUM1RCxNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsT0FBTztTQUNsRCxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLHNCQUFzQixDQUFDO1NBQ3ZFLEdBQUcsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLEVBQUU7UUFDdEIsTUFBTSxRQUFRLEdBQUcsTUFBTSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDaEYsT0FBTztZQUNMLFlBQVksRUFBRyxRQUFRLENBQUMsUUFBK0MsQ0FBQyxZQUFZO1lBQ3BGLFFBQVE7WUFDUixNQUFNLEVBQUUsOEJBQThCLENBQUMsUUFBUSxDQUFDO1NBQ2pELENBQUM7SUFDSixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ04sT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ2xDLE9BQU8sQ0FBQyxZQUFZLEdBQUcsUUFBUSxDQUFDLFlBQVk7UUFDMUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNKLENBQUMsQ0FBQyxPQUFPLENBQUMsWUFBWSxHQUFHLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUN6RCxDQUFDLENBQUM7SUFDSCxJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsTUFBTTtXQUNoRixJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLE1BQU07V0FDN0UsSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNqRixNQUFNLElBQUksS0FBSyxDQUFDLGtGQUFrRixDQUFDLENBQUM7SUFDdEcsQ0FBQztJQUNELE9BQU87UUFDTCxhQUFhLEVBQUUsQ0FBQztRQUNoQixVQUFVLEVBQUUsV0FBVyxDQUFDLEVBQUU7UUFDMUIsY0FBYyxFQUFFLFdBQVcsQ0FBQyxNQUFNO1FBQ2xDLE9BQU87S0FDUixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUNuRCxNQUFlLEVBQ2YsV0FBb0MsRUFDbEIsRUFBRTtJQUNwQixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUNoQixDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLFNBQVMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN6RixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLGdDQUFnQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3JFLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDLENBQUM7QUFPRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxDQUNqRCxlQUF5QixFQUNPLEVBQUU7SUFDbEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDO1dBQzlCLGVBQWUsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUM1QixlQUFlLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxPQUFPLFdBQVcsS0FBSyxRQUFRO2VBQ25FLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUN4QixXQUFXLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNuQyxNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE9BQU87UUFDTCxPQUFPLEVBQUUsQ0FBQywwQkFBMEIsQ0FBQztRQUNyQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLDhCQUE4QixFQUFFLElBQUksRUFBRSxHQUFHLGVBQWUsQ0FBQztLQUNqRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBa0RGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDakQsaUJBQWlCLEVBQUUsRUFBRTtDQUN0QixDQUFDLENBQUM7QUFFSCxNQUFNLHVCQUF1QixHQUFHLHVDQUF1QyxDQUFDO0FBRXhFLE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQzdDLFlBQXFCLEVBQ1gsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDO1FBQUUsT0FBTyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDM0UsTUFBTSxjQUFjLEdBQUcsWUFBWSxDQUFDLGNBQWMsQ0FBQztJQUNuRCxNQUFNLFlBQVksR0FBRyxjQUFjLEtBQUssUUFBUTtRQUM5QyxDQUFDLENBQUMsQ0FBQyxlQUFlLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLENBQUM7UUFDakcsQ0FBQyxDQUFDLGNBQWMsS0FBSyxVQUFVO1lBQzdCLENBQUMsQ0FBQyxDQUFDLGVBQWUsRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxhQUFhLENBQUM7WUFDaEgsQ0FBQyxDQUFDLGNBQWMsS0FBSyxTQUFTO2dCQUM1QixDQUFDLENBQUMsQ0FBQyxlQUFlLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDO2dCQUM5RyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1gsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUMzRSxPQUFPLENBQUMsc0RBQXNELENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksWUFBWSxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzlGLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksT0FBTyxZQUFZLENBQUMsU0FBUyxLQUFLLFFBQVE7V0FDekMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsWUFBWSxFQUFFLGFBQWEsQ0FBVSxFQUFFLENBQUM7UUFDM0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUssWUFBWSxDQUFDLEtBQUssQ0FBWSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RGLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0JBQW9CLEtBQUssNkJBQTZCLENBQUMsQ0FBQztRQUN0RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksY0FBYyxLQUFLLFVBQVU7V0FDNUIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQztlQUM3QyxZQUFZLENBQUMsV0FBc0IsSUFBSyxZQUFZLENBQUMsV0FBc0IsQ0FBQyxFQUFFLENBQUM7UUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxJQUFJLGNBQWMsS0FBSyxTQUFTO1dBQzNCLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUM7ZUFDM0MsWUFBWSxDQUFDLFNBQW9CLEdBQUksWUFBWSxDQUFDLFdBQXNCLENBQUMsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FDeEMsYUFBc0IsRUFDWixFQUFFO0lBQ1osSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1dBQzVCLGFBQWEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUMxQixhQUFhLENBQUMsTUFBTSxHQUFHLHFCQUFxQixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDcEUsT0FBTztZQUNMLG1EQUFtRCxxQkFBcUIsQ0FBQyxpQkFBaUIsVUFBVTtTQUNyRyxDQUFDO0lBQ0osQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLGFBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxZQUFZLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUMvRCwrQkFBK0IsQ0FBQyxZQUFZLENBQUM7U0FDMUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxjQUFjLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQyxDQUM1RCxDQUFDLENBQUM7SUFDSCxNQUFNLFVBQVUsR0FBRyxhQUFhLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsWUFBWSxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0YsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDN0UsTUFBTSxXQUFXLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlFLElBQUksSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ25HLElBQUksSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDZDQUE2QyxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELE1BQU0sZUFBZSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDcEcsTUFBTSxrQkFBa0IsR0FBRyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUMsYUFBYSxFQUEyQixFQUFFLENBQUMsQ0FDeEYsTUFBTSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsQ0FDcEMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxlQUFlO1dBQ2QsTUFBTSxDQUFDLGFBQWEsQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO1dBQ2hELGtCQUFrQixDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzdCLGVBQWUsQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLG1EQUFtRDtBQUNuRCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUN2QyxZQUFzQyxFQUM3QixFQUFFLENBQUMsWUFBWSxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUM7QUFFdkQsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsS0FBSyxFQUN2RCxhQUFzQixFQUN0QixZQUFzQyxFQUN0QyxrQkFBOEIsRUFDWCxFQUFFO0lBQ3JCLE1BQU0sTUFBTSxHQUFHLHdCQUF3QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3ZELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLElBQUksYUFBYSxDQUFDLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNyRixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDN0MsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqRixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssWUFBWSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sMkJBQTJCLENBQUMsUUFBUSxFQUFFLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztZQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDakUsQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxnRUFBZ0U7SUFDbEUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLG9GQUFvRjtBQUNwRixNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUN6QyxZQUFzQyxFQUN0QyxXQUFtQixFQUNuQixNQUFjLEVBQ0wsRUFBRSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDO09BQzFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDO09BQzVCLFdBQVcsSUFBSSxZQUFZLENBQUMsV0FBVztPQUN2QyxXQUFXLElBQUksTUFBTTtPQUNyQixDQUFDLFlBQVksQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUN6QyxDQUFDLFlBQVksQ0FBQyxjQUFjLEtBQUssVUFBVTtlQUN6QyxXQUFXLEdBQUcsWUFBWSxDQUFDLFdBQVc7ZUFDdEMsTUFBTSxHQUFHLFlBQVksQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBRTNDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxRQUFzQixFQUEwQixFQUFFO0lBQzlFLFFBQVEsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3RCLEtBQUssU0FBUyxDQUFDLENBQUMsT0FBTyxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDOUUsS0FBSyxZQUFZLENBQUMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNyRixLQUFLLG1CQUFtQixDQUFDLENBQUMsT0FBTztZQUMvQixJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUk7WUFDbkIsZ0JBQWdCLEVBQUUsUUFBUSxDQUFDLGdCQUFnQjtTQUM1QyxDQUFDO1FBQ0YsS0FBSyxRQUFRLENBQUMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUM3RSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFdBQTRCLEVBQTJCLEVBQUUsQ0FBQyxDQUN6RixXQUFXLENBQUMsSUFBSSxLQUFLLHNCQUFzQjtJQUN6QyxDQUFDLENBQUM7UUFDRSxJQUFJLEVBQUUsV0FBVyxDQUFDLElBQUk7UUFDdEIsWUFBWSxFQUFFLFdBQVcsQ0FBQyxZQUFZO1FBQ3RDLEdBQUcsRUFBRSxXQUFXLENBQUMsR0FBRztRQUNwQixHQUFHLEVBQUUsV0FBVyxDQUFDLEdBQUc7UUFDcEIsSUFBSSxFQUFFLFdBQVcsQ0FBQyxJQUFJO0tBQ3ZCO0lBQ0gsQ0FBQyxDQUFDO1FBQ0UsSUFBSSxFQUFFLFdBQVcsQ0FBQyxJQUFJO1FBQ3RCLFVBQVUsRUFBRSxXQUFXLENBQUMsVUFBVTtRQUNsQyxHQUFHLEVBQUUsV0FBVyxDQUFDLEdBQUc7UUFDcEIsR0FBRyxFQUFFLFdBQVcsQ0FBQyxHQUFHO1FBQ3BCLElBQUksRUFBRSxXQUFXLENBQUMsSUFBSTtLQUN2QixDQUNOLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlDLEVBQWMsRUFBRSxDQUFDLENBQ3RFLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FDbkQsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsVUFPakQsRUFBYyxFQUFFLENBQUMsWUFBWSxDQUFDO0lBQzdCLGFBQWEsRUFBRSxDQUFDO0lBQ2hCLE9BQU8sRUFBRSwwQkFBMEI7SUFDbkMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO0lBQ2pDLE1BQU0sRUFBRSxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO0lBQy9DLEdBQUcsRUFBRSxVQUFVLENBQUMsR0FBRztJQUNuQixXQUFXLEVBQUUsVUFBVSxDQUFDLFdBQVc7SUFDbkMsUUFBUSxFQUFFLHVCQUF1QixDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7SUFDdEQsNkJBQTZCLEVBQUUsVUFBVSxDQUFDLDZCQUE2QjtDQUN4RSxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUFDLFVBTWpELEVBQWMsRUFBRSxDQUFDLFlBQVksQ0FBQztJQUM3QixhQUFhLEVBQUUsQ0FBQztJQUNoQixPQUFPLEVBQUUsMEJBQTBCO0lBQ25DLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtJQUNqQyxRQUFRLEVBQUUsVUFBVSxDQUFDLFFBQVE7SUFDN0Isc0JBQXNCLEVBQUUsVUFBVSxDQUFDLHNCQUFzQjtJQUN6RCx1QkFBdUIsRUFBRSxVQUFVLENBQUMsdUJBQXVCO0lBQzNELDZCQUE2QixFQUFFLFVBQVUsQ0FBQyw2QkFBNkI7Q0FDeEUsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FBQyxVQVExRCxFQUFjLEVBQUUsQ0FBQyxZQUFZLENBQUM7SUFDN0IsYUFBYSxFQUFFLENBQUM7SUFDaEIsT0FBTyxFQUFFLCtCQUErQjtJQUN4QyxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLO0lBQ3ZCLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtJQUNqQyxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO0lBQ25CLFFBQVEsRUFBRSx1QkFBdUIsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO0lBQ3RELFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtRQUMvQixDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFO1FBQ2xGLENBQUMsQ0FBQyxJQUFJO0NBQ1QsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FBQyxVQWMzRCxFQUFjLEVBQUUsQ0FBQyxZQUFZLENBQUM7SUFDN0IsYUFBYSxFQUFFLENBQUM7SUFDaEIsT0FBTyxFQUFFLHFDQUFxQztJQUM5QyxjQUFjLEVBQUUsVUFBVSxDQUFDLGNBQWM7SUFDekMsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO0lBQ3pDLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztJQUMvQixTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO0lBQ3pDLHNCQUFzQixFQUFFLFVBQVUsQ0FBQyxzQkFBc0I7SUFDekQsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtJQUNyRCxlQUFlLEVBQUUsVUFBVSxDQUFDLGVBQWU7SUFDM0MsdUJBQXVCLEVBQUUsVUFBVSxDQUFDLHVCQUF1QjtJQUMzRCxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO0lBQ3pDLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUTtJQUM3QixlQUFlLEVBQUUsVUFBVSxDQUFDLGVBQWU7Q0FDNUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FBQyxVQU8vRCxFQUFjLEVBQUUsQ0FBQyxZQUFZLENBQUM7SUFDN0IsYUFBYSxFQUFFLENBQUM7SUFDaEIsT0FBTyxFQUFFLGtEQUFrRDtJQUMzRCxZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7SUFDckMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTO0lBQy9CLGNBQWMsRUFBRSxVQUFVLENBQUMsY0FBYztJQUN6QyxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO0lBQ2pDLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztDQUNoQyxDQUFDLENBQUMifQ==
|